SearchLeak: How We Turned M365 Copilot Into a One-Click Data Exfiltration Weapon

Summary

Varonis Threat Labs disclosed SearchLeak, a critical vulnerability chain in Microsoft 365 Copilot Enterprise Search that lets an attacker silently exfiltrate sensitive data — including MFA/security codes, email messages, meeting details, SharePoint documents, and OneDrive files — from a victim through a single click of an unsuspicious link. Microsoft remediated the issue under CVE-2026-42824 and assigned it a maximum severity, critical rating.^[17][37][38]

The chain stitches together three individually limited weaknesses: a Parameter-to-Prompt (P2P) injection in which Copilot Enterprise Search's 'q' URL parameter is passed directly to Copilot as an executable prompt, an HTML rendering race condition in which an image tag in the AI response fires before the output sanitizer kicks in, and a Content-Security-Policy bypass via a server-side request forgery in Bing's allowlisted image-search endpoint. Because the malicious link resolves to a trusted microsoft.com domain, conventional anti-phishing and URL-filtering tools do not flag it.^[17]

The research illustrates how classic, normally containable web bugs such as SSRF and HTML injection race conditions can be weaponized into potent, hard-to-detect data-exfiltration attacks once prompt injection is possible inside an AI assistant, showing that AI features create new pathways into systems built on older weaknesses. Microsoft has already fixed the flaw, so no user action is required to mitigate this specific vulnerability.^[17]

Attack chain

1. Delivery — crafted single-click link: A victim operating inside a Copilot Enterprise tenant clicks a specially crafted link that launches Microsoft 365 Copilot Enterprise Search. The link points to a trusted microsoft.com domain, so anti-phishing and URL-protection tools do not filter it, and no second click is needed.^[17]
2. Stage 1 — Parameter-to-Prompt (P2P) injection: The 'q' URL parameter accepted by Copilot Enterprise Search is passed directly to Copilot as an executable prompt, causing Copilot to search the victim's mailbox, calendar, and indexed organizational content and to format the retrieved data.^[17]
3. Stage 2 — HTML rendering race condition: An HTML tag in the AI response fires before the output sanitizer kicks in, allowing an attacker-controlled image request to execute during response rendering.^[17]
4. Stage 3 — CSP bypass via Bing SSRF: Bing's image-search endpoint, which is allowlisted in the Content Security Policy, performs a server-side fetch to an attacker-controlled URL, bypassing CSP and acting as an unwitting exfiltration proxy.^[17]
5. Exfiltration: The victim's data, carried in the fetched request, ends up on the attacker's server — extracting emails, calendar entries, and indexed organizational content without alerting the user.^[17]

Disclosure timeline

How it works

SearchLeak abuses the fact that Microsoft 365 Copilot Enterprise Search passes the 'q' URL parameter directly to Copilot as an executable prompt (Parameter-to-Prompt injection). A crafted link can therefore instruct Copilot to search the victim's mailbox, calendar, SharePoint, and OneDrive and to format the retrieved content without the victim typing anything.^[17]

The retrieved data is exfiltrated via an HTML rendering race condition: an image tag in the AI response fires before Copilot's output sanitizer neutralizes the markup, triggering an outbound request during rendering.^[17]

The outbound fetch is routed through Bing's image-search endpoint, which is allowlisted in Copilot's Content Security Policy. Because Bing performs the server-side request to the attacker-controlled URL, the SSRF bypasses the CSP allowlist and delivers the embedded stolen data to the attacker's server.^[17]

Affected versions and patch status

Key takeaways

• Familiar, normally containable web bug classes like SSRF and HTML injection race conditions can be weaponized into high-impact, silent data-exfiltration attacks once prompt injection is available in an AI assistant's context.^[17]
• Trusted-domain delivery matters: because the SearchLeak link pointed to microsoft.com, conventional anti-phishing and URL-filtering defenses did not flag it, showing that AI-integrated products expand the attack surface beyond what traditional controls inspect.^[17]
• AI features that pass URL parameters directly into model prompts (Parameter-to-Prompt injection) create new pathways to exploit older bug classes in contexts where they previously had limited impact.^[17]

Defensive actions

• Confirm Microsoft's CVE-2026-42824 remediation is in effect across affected Copilot Enterprise tenants.: Microsoft fixed the vulnerability, and once the fix is applied no user action is required to mitigate this specific threat.^[17][37]
• Review how Microsoft 365 is connected to the wider environment and constrain the organizational content indexed and surfaced by Copilot Enterprise Search.: Because SearchLeak targets the Enterprise tier, the blast radius covers any content the user can access and could extend further depending on M365 connectivity.^[17]
• Be wary of single-click links to trusted vendor domains such as microsoft.com, and treat AI-assistant behaviors that combine prompt injection with outbound rendering (such as image tags fetching external URLs) as a monitored risk pattern.: The SearchLeak link resolved to a trusted microsoft.com domain that bypassed anti-phishing controls, and classic bugs such as SSRF and HTML injection race conditions become potent, hard-to-detect exfiltration paths when prompt injection is available.^[17]