Microsoft 365 Copilot Vulnerability Exposes Sensitive Data Through One-Click Attack

Microsoft 365 Copilot has been found vulnerable to a critical one-click data exfiltration attack chain dubbed “SearchLeak,” exposing sensitive enterprise data through a combination of AI-specific and traditional web vulnerabilities.

Discovered by Varonis Threat Labs, the flaw, tracked as CVE-2026-42824 and rated critical, demonstrates how modern AI integrations can unintentionally expand attack surfaces by linking prompt injection with legacy security weaknesses.

The vulnerability affects Microsoft 365 Copilot Enterprise Search. It enables attackers to extract confidential information such as MFA codes, email content, meeting data, and files stored across SharePoint and OneDrive, all triggered by a single user interaction.

Microsoft 365 Copilot Vulnerability

At the core of the attack is a three-stage exploit chain that begins with a Parameter-to-Prompt (P2P) injection flaw. Microsoft 365 Copilot Enterprise Search accepts a query parameter in URLs intended for natural language searches.

However, researchers found that this parameter is interpreted not only as input but also as executable instructions by Copilot’s AI engine. This allows attackers to craft malicious links that embed hidden prompts directing Copilot to retrieve sensitive organizational data.

Because Copilot operates with the permissions of the logged-in user, even low-privileged accounts can be leveraged to access valuable internal data.

The second stage involves an HTML injection race condition during Copilot’s response rendering process. While Microsoft attempts to mitigate malicious output by wrapping responses in code blocks, this sanitization occurs after the AI has already begun streaming its output.

During this brief window, the browser can render injected HTML, such as an image tag, before the protection is applied. This enables the browser to execute outbound requests containing embedded sensitive data before the content is neutralized. This timing flaw effectively bypasses output-encoding protections, allowing silent data leakage.

The final stage exploits a server-side request forgery (SSRF) vector using a trusted Microsoft domain. Due to Content Security Policy (CSP) restrictions, browsers block requests to untrusted domains.

However, Microsoft’s CSP allows Bing services, including its image search functionality. Attackers abuse this by embedding exfiltrated data within a Bing image search request URL.

When the victim’s browser loads the image, Bing’s backend servers fetch the attacker-controlled URL, unknowingly transmitting the sensitive data. This indirect exfiltration method bypasses browser-level protections and leverages Microsoft infrastructure as a proxy.

In a real-world attack scenario, a victim receives a seemingly legitimate Microsoft link via email or messaging platforms such as Teams or Slack.

Upon clicking, Copilot automatically executes the injected prompt, searches enterprise data sources, and generates a response containing hidden exfiltration payloads.

The data is then transmitted externally during the rendering phase without requiring additional interaction. Because the link originates from a trusted Microsoft domain, traditional phishing defenses and URL filtering mechanisms fail to detect or block the attack.

The impact of SearchLeak is significant, particularly in enterprise environments where Copilot integrates deeply with organizational data.

Attackers can access email subject lines containing one-time passwords, confidential communications, meeting agendas, and sensitive corporate documents such as financial reports or strategic plans.

Since the attack does not require authentication beyond the victim’s session, it effectively grants attackers indirect access to enterprise data without triggering conventional security alerts.

Microsoft has since patched the vulnerability, but SearchLeak highlights a broader security challenge in AI-driven systems. By combining prompt injection with race conditions and SSRF, the research illustrates how AI can act as a bridge, making previously isolated vulnerabilities exploitable in new contexts.

This discovery follows earlier findings, such as the “Reprompt” vulnerability, and underscores the need for robust input validation, real-time output sanitization, and stricter control over AI-driven data access.

As organizations continue adopting AI assistants like Copilot, security teams must reassess threat models to account for AI-mediated attack paths. The SearchLeak vulnerability is a critical example of how a single click can turn a productivity tool into a powerful data exfiltration channel.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.