EchoLeak Incident: Copilot's Hidden Risk & How to Protect Data

I recently reviewed Copilot's permissions in our AGAPE Automation Systems tenant. What I found made me revisit the EchoLeak incident and calculate what a single such leak would cost me.

When I first read about EchoLeak, I thought Microsoft had patched the issue and the case was closed. Then I checked the scope of documents Copilot has access to in our tenant and realized that the latest patch only removes one attack vector, not the fundamental problem of overly broad access.

At AGAPE, from the very beginning, we designed our Zero-Hallucination technology to limit the scope of data visible to the model. This is not just to avoid hallucinations, but precisely to ensure there's nothing to exfiltrate in an EchoLeak-type attack. Our AGAPE Octopus system operates on the same principle: the less data the model sees, the lower the machine's maintenance cost and the lower the risk.

How Much Do You Really Know About What Your People Paste into AI?

Half of all pasting activity into generative AI tools involves company data: quotes, margins, client emails, payrolls. The other half consists of ordinary questions that nevertheless trigger a search across the entire context available to the AI.

89 percent of logins to AI tools happen outside the control of standard corporate mechanisms. People log in with private accounts, in unmonitored browsers, or through plugins in Word or Teams. The IT department doesn't see this in any report, because no such report exists.

At AGAPE, we've introduced a simple registry: for each AI tool, its permissions and the scope of data it can access. Without such a registry, the total cost of ownership (TCO) of the machine increases with hidden items not visible in the subscription fee.

How EchoLeak Exfiltrated Data - The Mechanism Step-by-Step

An attacker sent an email formatted to appear as relevant material for typical queries about onboarding, HR procedures, or a quarterly report. Keywords like 'AI', 'Copilot', or 'prompt' were deliberately omitted to bypass classifiers.

The RAG (Retrieval-Augmented Generation) mechanism in Copilot identified the email as context and included its content in the LLM's processing. The malicious content instructed the model to find the most sensitive data in the current context and embed it in the URL of a Markdown image.

The Copilot client automatically attempted to load the image, sending an HTTP request to the attacker's external server. The data was leaked in the URL, without any click, file download, or visible user action.

Even companies that blocked public chatbots and used Copilot exclusively within their own Microsoft 365 environment remained vulnerable. The attack worked precisely in the supposedly closed M365 environment.

LLM Scope Violation as a Flaw in RAG Architecture

EchoLeak was not a single product bug. It's a symptom of a broader class of problems called LLM Scope Violation. Untrusted external data influences the processing of trusted internal information because the model, by definition, mixes both sources with every query.

As long as Copilot searches emails and documents with every question, external content can influence what the system does with internal data. The recent patch removed one specific vector, but it didn't change the architecture where RAG combines broad permissions with automatic rendering of external content.

At AGAPE, after EchoLeak, I no longer ask if a tool is secure. I ask how many documents it can see that it shouldn't have access to, and what a leak of one of them would cost.

What Does One Such Leak Cost?

The cost is not limited to the subscription fee. A fine from a regulator can reach up to 4% of annual turnover. Losing a single B2B client can mean the loss of a contract worth hundreds of thousands. The cost of crisis communication and a post-leak audit starts at several thousand.

At AGAPE, we calculate the cost per completed task. When a model has access to the entire mailbox and all SharePoint files, every task becomes more expensive due to the added risk. Our Zero-Hallucination technology limits this access to the minimum required by the user's role, keeping the TCO predictable.

What to Do After EchoLeak: Audit and Control

First, conduct a permissions audit in your Microsoft 365 tenant. Restrict Copilot's access to mailboxes and folders that are not essential for daily queries. Introduce a policy that every new AI tool goes through a registry with a permissions map.

Second, check the automatic loading feature for external content in your tools. Where possible, disable the rendering of Markdown images from unknown sources. Microsoft states that Copilot respects existing permissions, so the narrower the scope, the lower the risk in the next similar incident.

The key question to ask is: how many documents in your company have broader permissions than their owner's role requires? If you don't know the answer, that's your first audit point.