Copilot Vision Just Launched on Windows — Here’s What It Actually Does
- In January 2025, Aim Security researchers discovered and reported a critical zero-click vulnerability called EchoLeak affecting Microsoft 365 Copilot AI tool.
- The flaw allowed attackers to send a malicious email embedding hidden prompts that could extract sensitive internal data without user interaction or malware.
- Microsoft fixed the issue server-side in May 2025, assigned it CVE-2025-32711, and stated no customers were affected or required action.
- Aim Security's Adir Gruss called EchoLeak a significant breakthrough but warned such flaws reveal fundamental design risks in AI agents and broader data exposure.
- The event underscores the importance of implementing strong AI security protocols as Microsoft introduces Copilot Vision, which increases AI’s access to user devices and thereby raises new challenges for securing AI agents.
29 Articles
29 Articles
Hackers Could Steal Data From Microsoft 365 Copilot Without Phishing Or Malware, Says AI Startup — 'EchoLeak' Flaw Took 5 Months To Fix - Alphabet (NASDAQ:GOOG), Alphabet (NASDAQ:GOOGL)
A critical security flaw was discovered in Microsoft (NASDAQ: MSFT) 365 Copilot, an AI tool integrated into various Microsoft Office applications. This vulnerability could potentially lead to attacks on sensitive data.
The company introduced Copilot Vision for Windows, an extension of its AI assistant that can “see” and analyze the apps, files, or web pages that the user shares.
Coverage Details
Bias Distribution
- 100% of the sources are Center
To view factuality data please Upgrade to Premium