Unverified50% confidenceEventExact time
In June 2025, AIM Security disclosed the EchoLeak vulnerability in Microsoft 365 Copilot: an email carrying hidden instructions could make Copilot send sensitive data to an attacker without any user click.
1
Sources
50%
Confidence
Medium-term (~90 days)
Relevance
10/17/2026
First Seen
Valid until: 1/15/2027
Sources
Related Entities
Related Claims
Unverified2024年安全研究员Johann Rehberger公开演示了针对Microsoft 365 Copilot的提示注入攻击，通过邮件正文嵌入人眼不可见的恶意指令，当用户让Copilot总结收件箱时执行隐藏指令，将敏感邮件内容通过超链接参数外泄到攻击者服务器68% similarUnverifiedOn January 14, 2026, PromptArmor published an experiment showing that an attacker, by uploading a Word file containing hidden instructions, exploited Anthropic's own API in the VM whitelist to make a curl call a legitimate outbound request and exfiltrate private files from the local machine, with no manual approval required during the process.63% similarUnverified通过非官方平台获取的API密钥，其请求经中间服务器转发，对话内容、代码、提示词可能被中间方记录，存在敏感数据泄露风险61% similarUnverified2024年安全研究者发现的ASCII走私技术利用Unicode中人眼不可见但AI可解读的特殊字符隐藏恶意指令，该技术已在Microsoft Copilot等产品中被验证有效61% similarUnverifiedBy 2024, security researchers had demonstrated indirect prompt injection attacks that hijack RAG system outputs by embedding hidden instructions in web pages60% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1056147API
curl https://kongchang.com/api/v1/knowledge/claims/1056147MCP
get_claim(id=1056147)