Imagine clicking what looks like a perfectly ordinary Microsoft link — and in that single moment, silently handing an attacker your emails, MFA codes, meeting notes, and confidential company files. No password prompt. No suspicious pop-up. No warning of any kind. This is not a hypothetical scenario from a sci-fi thriller. This is exactly what the newly disclosed SearchLeak vulnerability in Microsoft 365 Copilot Enterprise made possible — and it serves as a stark, urgent wake-up call for every business running AI-powered productivity tools.
Researchers have uncovered a critical vulnerability chain, dubbed SearchLeak, in Microsoft 365 Copilot Enterprise that allows attackers to exfiltrate sensitive corporate data — including MFA codes, emails, calendar details, and confidential files — with a single click on a link from a legitimate Microsoft domain.
The disclosure, made on June 15, 2026, has sent shockwaves through the enterprise cybersecurity community, and rightfully so.
In this post, we'll break down exactly what SearchLeak is, how it works, what data was at risk, and — most importantly — what you and your organisation should do right now to stay protected.
What Is SearchLeak? The Vulnerability Explained
SearchLeak is not a single flaw; it is a chained exploit that weaponises Microsoft 365 Copilot Enterprise Search as a silent data exfiltration engine. Uncovered by Varonis Threat Labs researcher Dolev Taler, the attack combines three distinct weaknesses.
Dubbed SearchLeak and tracked as CVE-2026-42824, the flaw earned Microsoft's maximum severity rating before being patched.
Microsoft assigned CVE-2026-42824 and marked it critical; the CVSS scores ran lower and disagreed — 6.5 from Microsoft and 7.5 from the National Vulnerability Database.
What makes SearchLeak so alarming isn't just the technical sophistication — it's the deceptive simplicity from a victim's perspective.
The victim sees only Copilot "thinking" — no visible data movement occurs.
From the outside, nothing unusual happens at all.
Varonis researchers discovered the issue in late 2025 while auditing AI-integrated Microsoft 365 environments. They reported it to Microsoft in January 2026, following responsible disclosure practices.
How the Attack Works: A Three-Stage Chain
Understanding the mechanics of SearchLeak is crucial for grasping why it was so dangerous — and why AI-integrated tools are fundamentally reshaping the threat landscape.
Stage 1: Parameter-to-Prompt (P2P) Injection
The entry point is the q parameter in the Copilot Enterprise Search URL. It is meant for a natural-language query, but Copilot reads whatever sits there as instructions, not just a search string. Varonis calls this Parameter-to-Prompt injection.
An attacker writes a URL that tells Copilot to search the mailbox, take an email title, and place it inside an image URL. The victim types nothing — they click, and Copilot does the work.
In other words, the attacker doesn't need to compromise an account or brute-force a password. They simply craft a URL and send it. Copilot, ever-helpful, follows the embedded instructions to the letter.
Stage 2: HTML Rendering Race Condition
An <img> tag in the AI response fires before the output sanitiser kicks in.
During the response streaming, an HTML rendering race condition allows an attacker-controlled image tag to execute, embedding the exfiltrated data within an image URL.
Microsoft's built-in guardrails are designed to wrap Copilot's output so that browsers treat markup as plain text. But by exploiting the timing window during streaming, the attacker's image tag fires just before those protections engage — making this a classic, but devastatingly effective, race condition.
Stage 3: CSP Bypass via Bing SSRF
The final stage is perhaps the cleverest part of the chain.
Bing's image-search endpoint, allowlisted in the Content Security Policy, performs a server-side fetch to an attacker-controlled URL.
This URL is then sent to Bing's "Search by Image" feature, which bypasses CSP protections and fetches the data from the attacker's endpoint.
With the stolen data embedded in the URL, the attacker can read it from their server's request logs. "Bing becomes an unwitting exfiltration proxy — a classic SSRF, hiding in plain sight behind a CSP allowlist entry," the researchers concluded.
What Data Was at Risk?
The scope of what SearchLeak could access is genuinely alarming, especially for enterprise organisations where Microsoft 365 is the operational backbone.
Through this attack, threat actors could receive mail subject lines and content, including security codes, password reset links, and more; meeting details; and private organisational files indexed by Copilot — including sensitive business documents.
Since SearchLeak targets the Enterprise tier of Microsoft, the blast radius isn't limited to personal data — it's able to surface anything the user has access to inside the organisation, including emails, meeting invites and notes, SharePoint documents, OneDrive files, and other indexed business content.
Depending on how M365 is connected to the environment, the blast radius could extend even wider.
The vulnerability could bypass data loss prevention (DLP) policies, as Copilot's internal processing isn't always subject to the same egress filters as user-initiated actions. Exfiltrated data could include anything Copilot can access — which in an enterprise setting often spans financial records, intellectual property, and personally identifiable information.
Why Traditional Security Tools Couldn't Stop It
One of the most unsettling aspects of SearchLeak is how comprehensively it circumvented standard enterprise defences.
Because the attack originates from a real microsoft.com domain, conventional anti-phishing tools and URL filters fail to flag it entirely.
Your employees are well-trained to avoid suspicious links from unknown senders — but what about a link that genuinely comes from Microsoft's own domain?
The attack works like this: the threat actor sends the victim a Copilot link through any channel, such as email or Slack.
No plugins, no elevated permissions, and no second click from the victim are required.
The attack continued to run even when the user closed the Copilot chat, with no further interaction needed once the user clicked the link in the email. The attack and resulting data theft bypassed enterprise endpoint security controls and detection by endpoint protection apps.
The exploit underscores a broader risk: AI assistants like Copilot amplify existing access permissions, meaning overly permissive identities can be exploited at scale.
This is the fundamental tension at the heart of enterprise AI adoption — the same broad access that makes Copilot extraordinarily useful also makes it extraordinarily dangerous when compromised.
SearchLeak in Context: A Growing Pattern of AI Vulnerabilities
SearchLeak did not emerge in isolation. It is the latest in a disturbing pattern of Copilot-related security disclosures that security teams need to understand.
SearchLeak is the second time Varonis has demonstrated this pattern against Copilot. Varonis researcher Dolev Taler previously disclosed the Reprompt attack against Copilot Personal, which used the same one-click technique to exfiltrate data. That vulnerability was reported to Microsoft in August 2025 and patched in January 2026.
The same class of bug appeared independently in EchoLeak, a zero-click Copilot vulnerability disclosed by Aim Security in 2025 and tracked as CVE-2025-32711 with a CVSS score of 9.3. EchoLeak required no user interaction at all, embedding prompt injections in documents that Copilot processed automatically.
Together, these findings underscore how AI assistants are creating new, hard-to-detect attack surfaces by reactivating previously unexploitable classic vulnerabilities in new contexts.
Dor Yardeni, director of security research at Varonis, notes that SearchLeak is more than a single issue in a single AI application — "it is a wider class of risks in LLM-powered enterprise assistants, especially those that combine external input, like links or prompts, with internal data access."
According to the OWASP Top 10 for Agentic Applications (2026), published by Microsoft's Security Blog in March 2026, indirect prompt injection is the leading risk category for agentic AI systems.
SearchLeak is a real-world proof of exactly that.
Has Microsoft Fixed It? What You Need to Know Right Now
The good news — and it is genuinely good news — is that this vulnerability has been addressed.
Microsoft has fully patched SearchLeak server-side.
Microsoft mitigated the flaw on its backend, and because Copilot Enterprise is a managed service, tenant admins cannot patch or reconfigure the parts that failed.
The company patched the flaw on its backend at the beginning of June 2026, requiring no action from customers, and Varonis disclosed only a proof-of-concept with no evidence of in-the-wild exploitation.
So there is no emergency patch for end-users to deploy in this specific instance. However, the disclosure should prompt every enterprise to re-examine how they govern, monitor, and contain Microsoft 365 Copilot — because the next vulnerability in this class may not be discovered by friendly researchers first.
Practical Tips: How to Protect Your Organisation from AI-Driven Data Theft
Even with this specific vulnerability patched, the broader class of AI-powered data exfiltration attacks is not going away. Here is what you can and should do immediately.
🔒 1. Conduct a Permissions Audit Before Anything Else
Microsoft recommends SharePoint Advanced Management for a systematic permission review. Eliminate "Anyone" links, identify orphaned workspaces, and resolve nested group permissions. No Copilot access should be granted without a completed permission audit.
🏷️ 2. Apply Sensitivity Labels Across All Data
Apply Microsoft Purview Information Protection labels to all documents and emails. Without labels, there's no effective DLP control — and Copilot ignores what isn't labelled.
🛡️ 3. Configure DLP Policies Specifically for Copilot
Configure DLP policies for Copilot. Since 2025, Microsoft Purview DLP has explicitly supported the "Microsoft 365 Copilot" location
— take full advantage of this.
👁️ 4. Monitor Copilot Search URLs for Encoded Payloads
Security teams should monitor Copilot Search URLs for encoded payloads in the q parameter containing HTML or image-embedding instructions, and audit CSP allowlists for any domain that performs server-side requests.
⚡ 5. Apply the Principle of Least Privilege Rigorously
AI assistants like Copilot amplify existing access permissions, meaning overly permissive identities can be exploited at scale.
Review every user's access rights and apply least-privilege principles — if Copilot can only access what a user genuinely needs, the potential blast radius of any future attack shrinks dramatically.
📋 6. Build an AI Governance Framework
The organisations that successfully manage AI Copilot security risks are not those with the largest security budgets — they are those that treat security as a foundational architectural requirement from the moment they decide to deploy AI Copilot systems.
Formalise your governance policies now, not after an incident.
🔎 7. Keep Threat Intelligence Up to Date
The SearchLeak disclosure is part of an evolving story.
The same pattern showed up in EchoLeak (CVE-2025-32711) and other vulnerabilities. SSRF and sanitiser races are old bug classes; the prompt injection is the new part — and it makes them reachable again.
Subscribe to advisories from Microsoft Security Response Center (MSRC), Varonis, and threat intelligence feeds relevant to your stack.
Conclusion: AI Power Comes with AI-Scale Risk
SearchLeak is a watershed moment for enterprise AI security. It demonstrates, with frightening clarity, that integrating powerful AI tools into your most sensitive data environments without rigorous security governance is not just risky — it is an open invitation to attackers.
The vulnerability chain exposed the dark side of AI-powered productivity tools, showing how the very feature designed to help workers find information could be weaponised to steal it.
The patch is deployed, but the lesson must not be forgotten.
Unlike traditional applications that perform a specific, predefined set of actions, "agentic" systems are designed to search, interpret, and synthesise large amounts of data in real time. This unique capability — the very source of their utility — also creates a new and complex attack surface, as attackers increasingly turn to "logical" vulnerabilities that manipulate the intended functionality of AI to achieve malicious results.
Your next step starts today. Conduct a Microsoft 365 permissions audit, review your Copilot governance policies, and engage a trusted cybersecurity partner to assess your AI attack surface before the next vulnerability is discovered. Don't wait for the next CVE to land in your inbox — act now, lock down your Copilot environment, and make sure your AI assistant is working for you, not for an attacker.
