If your team uses Microsoft 365 Copilot to search email, SharePoint, or OneDrive, a researcher could have stolen your data with a single click earlier this year — and you would never have seen it coming.
In June 2026, security researchers at Varonis Threat Labs disclosed a critical vulnerability chain in Microsoft 365 Copilot Enterprise Search called "SearchLeak," tracked as CVE-2026-42824. A victim who clicked one link could have had emails, calendar details, MFA codes, and indexed SharePoint or OneDrive files quietly exfiltrated to an attacker-controlled server — without opening a single suspicious attachment. Microsoft patched the flaw server-side in early June 2026, so no customer action was required to close this specific hole. But the pattern behind it is still very much alive, and it’s worth understanding if your business has rolled out Copilot, or is planning to.
What Actually Happened
SearchLeak wasn’t one bug — it was three ordinary flaws chained together into something dangerous.
According to Varonis’s technical writeup, the attack worked like this:
- **Parameter-to-prompt injection**: The search query parameter in a Copilot Enterprise Search URL accepted arbitrary instructions instead of just a search term, letting attackers embed hidden commands in an otherwise normal-looking Microsoft link.
- **A rendering race condition**: Microsoft’s guardrails sanitized Copilot’s output using `<code>` blocks, but the browser rendered streaming responses before that sanitization finished. An injected image tag could execute in that brief window.
- **A content security policy bypass**: Microsoft’s policy blocked external image requests but allowlisted `*.bing.com`. Attackers abused Bing’s "Search by Image" feature, which fetches images server-side, to relay stolen data out through a trusted domain.
Because the malicious link pointed to a genuine microsoft.com address, standard phishing filters and URL reputation tools had nothing to flag. As Varonis researcher Dolev Taler put it: "Without P2P, you can’t get attacker-controlled HTML into the response. Without the race condition, the HTML gets neutralized." Each piece was individually survivable. Together, they weren’t.
Why This Isn’t a One-Time Fluke
SearchLeak followed a near-identical 2025 incident known as EchoLeak (CVE-2025-32711), in which attackers used prompt injection to pull data out of a live Microsoft 365 Copilot environment without any user interaction at all. Two major, independently discovered Copilot data-exfiltration chains in twelve months isn’t a coincidence — it reflects a structural problem with how AI assistants process untrusted content.
Government security agencies are already treating this as a category, not an isolated bug. In April 2026, the Five Eyes intelligence alliance — including CISA and the NSA — published joint guidance on agentic AI adoption, naming prompt injection as a core technique attackers use to manipulate AI agents and warning that no single safeguard fully neutralizes it. For any business whose employees now ask Copilot to summarize an inbox, draft a reply, or pull up a file, that warning applies directly.
We’ve covered this broader pattern before in MCP Security Risks: What Businesses Should Know and in our piece on Shadow AI at Work. SearchLeak is the same underlying risk — an AI tool that trusts content it shouldn’t — showing up inside a product most businesses already consider "safe" because it comes from Microsoft.
What This Means If You Already Run Copilot
Microsoft’s own fix means you don’t need to patch anything for this specific CVE. What you do need is a plan for the next one, because the underlying class of vulnerability — AI agents processing attacker-controlled content as if it were a trusted instruction — isn’t going away. The Hacker News’s reporting on SearchLeak noted that the proof-of-concept required no unusual permissions and worked against standard Enterprise Search configurations, meaning any organization with Copilot licensed and turned on was exposed until the backend fix shipped.
Questions Worth Asking Your IT Provider
- Do we have logging in place that would catch unusual Copilot search activity, like a spike in email or file lookups tied to one link click?
- Are admins reviewing which third-party domains are allowlisted in our Microsoft 365 content security policies?
- Do we have a process for tracking Microsoft security advisories that affect Copilot, rather than relying on "Microsoft will just fix it"?
- Is MFA on every privileged account using an authenticator app or hardware key, not SMS — since MFA codes were specifically targeted in this attack?
Practical Steps to Take Now
Even though this particular flaw is patched, a few habits reduce your exposure to the next variant:
1. **Treat unexpected Microsoft 365 links with the same suspicion as any other link.** A legitimate-looking microsoft.com URL isn’t automatically safe if it carries an unusual, long, encoded query string.
2. **Restrict Copilot’s data scope where possible.** If certain SharePoint libraries or mailboxes don’t need to be searchable by AI, exclude them.
3. **Keep a current inventory of which AI tools touch your business data.** You can’t assess risk in tools you don’t know are connected — a theme we explored in depth in our Shadow AI piece above.
4. **Ask your managed IT provider to monitor Microsoft’s security advisories specifically for Copilot and related AI services**, not just general Windows and Exchange patches.
5. **Report unusual Copilot behavior immediately** — Varonis specifically flagged unsolicited email or file searches as a sign something may be wrong.
Frequently Asked Questions
**Do I need to manually patch anything for SearchLeak?**
No. Microsoft 365 Copilot Enterprise Search is a managed cloud service, and Microsoft remediated CVE-2026-42824 on its backend in early June 2026. No customer action was required for this specific flaw.
**Was SearchLeak actively exploited against real businesses?**
Varonis disclosed the vulnerability through responsible research and demonstrated a proof-of-concept; there are no public reports of confirmed in-the-wild exploitation before the patch shipped.
**Is Microsoft 365 Copilot generally safe to use for my business?**
It’s a Microsoft-managed product with a real security team behind it, but SearchLeak and the earlier EchoLeak flaw show that AI assistants processing untrusted content are a recurring attack surface. Safe use means pairing the tool with monitoring, scoped data access, and a provider that tracks AI-specific advisories — not assuming the product is risk-free by default.
The Bottom Line
SearchLeak is fixed, but it’s a preview of a pattern businesses will keep encountering as AI assistants get deeper access to company data: individually minor flaws chaining into serious exposure, hidden behind links and domains that look completely legitimate. If your business has adopted Microsoft 365 Copilot, or is about to, the question isn’t whether Microsoft will patch the next vulnerability — it’s whether your IT provider will know about it, and know what to check, before an attacker does.
If you want a second set of eyes on how Copilot is configured in your environment, DataTap Tech can review your Microsoft 365 security settings and AI data exposure as part of a standard IT audit for businesses.
Sources
- SearchLeak: How We Turned M365 Copilot Into a One-Click Data Exfiltration Weapon — Varonis Threat Labs
- One-Click Microsoft 365 Copilot Flaw Could Have Let Attackers Steal Emails, Files, and MFA Codes — The Hacker News
- Careful Adoption of Agentic AI Services — Five Eyes Joint Guidance (CISA, NSA, et al.)
