Researchers Reveal One-Click Microsoft 365 Copilot Data-Exfiltration Flaw

SearchLeak is worth attention less because Copilot shipped a flaw and more because none of its three component weaknesses is new, and none is dangerous alone. What makes them dangerous together is that an LLM with retrieval access now sits between a URL parameter and a browser's render pipeline. Any team running an enterprise AI copilot or retrieval-augmented agent that accepts free-text instructions through a URL parameter, streams model output into the DOM before sanitizing it, and allowlists a domain in its Content Security Policy that can be made to fetch attacker-supplied URLs server-side, has the same three ingredients Varonis Threat Labs chained here. That combination is common to copilot-style search products generally, not unique to Microsoft.

Dolev Taler, the Varonis Threat Labs researcher credited with the discovery, breaks SearchLeak into three stages. Microsoft 365 Copilot Enterprise Search's URL accepts a q parameter meant for natural-language queries; Copilot instead treats its contents as instructions, a technique Varonis calls parameter-to-prompt (P2P) injection. Microsoft's safeguard wraps AI output in code blocks so browsers render it as text, but that wrapping happens only after generation finishes, while the browser renders the streamed response as it arrives, so an attacker's injected image tag fires its outbound request before sanitization runs. The page's Content Security Policy blocks image loads from arbitrary domains but allowlists bing.com; Bing's "Search by Image" endpoint fetches a supplied URL server-side, so pointing it at an attacker's server with stolen text encoded in the path exfiltrates data without the victim's browser ever contacting the attacker directly. Each link is a known bug class alone: prompt injection, a sanitizer race condition, and server-side request forgery (SSRF). Chaining them through an AI response pipeline is the new part.

Varonis disclosed SearchLeak on June 15, 2026, after Microsoft had already mitigated it server-side at the start of the month, so the fix predates the public writeup and required no customer action. Microsoft assigned CVE-2026-42824. The path could reach email content including one-time codes and password-reset links, calendar and meeting details, and OneDrive or SharePoint files indexed by Copilot, essentially anything the signed-in user's Microsoft Graph permissions cover. Because the malicious link resolves to a genuine microsoft.com address, standard URL-reputation and anti-phishing filtering has no signal to act on. Varonis published a working proof-of-concept; neither Varonis nor Microsoft reported evidence of in-the-wild exploitation before the patch.

Microsoft's own advisory classifies the flaw as CWE-77 (command injection) and assigns it a CVSS 3.1 base score of 6.5 (vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N), scoring the click as required user interaction, alongside a qualitative "Critical" severity label. The National Vulnerability Database's independent analysis scores the same flaw 7.5 High, using a vector that marks user interaction as not required. NVD's own listing flags the mismatch directly. Both describe the same vulnerability; the gap is a scoring judgment about whether the one-click requirement counts as "user interaction" in CVSS terms, not a factual dispute about what the flaw does or how serious its consequences are.

• •Check whether URL or query-parameter input to your AI assistant is isolated from its instruction channel, not just treated as data.
• •Check whether model output streams into the DOM before or after sanitization; a race condition here is invisible if code review only checks the final rendered state.
• •Review CSP allowlists for any domain that performs server-side fetches on caller-supplied URLs; an allowlisted SSRF-capable endpoint is an exfiltration channel no matter how trustworthy the domain looks.
• •Treat AI search features with mailbox, file, or calendar retrieval access as a data-loss surface requiring export-level monitoring, not just a chat feature.

Varonis's own research history shows this is a recurring pattern: Reprompt (January 2026) used the same parameter-to-prompt technique against Copilot Personal, and EchoLeak (2025, CVE-2025-32711) was an earlier zero-click Copilot data-leak bug disclosed by Aim Security. A separate high-severity Copilot Chat information-disclosure flaw, CVE-2025-53787, was disclosed in 2025. Dor Yardeni, a Varonis director of security research, told Dark Reading that the underlying risk is not Copilot-specific: any LLM-powered assistant combining external input, internal data access, and output rendering in one flow "can potentially be abused in similar ways," which puts the fix on platform design choices like prompt isolation and output sanitization rather than on user behavior.