SearchLeak: How We Turned M365 Copilot Into a One-Click Data Exfiltration Weapon

Summary

Varonis Threat Labs disclosed SearchLeak, a critical vulnerability chain in Microsoft 365 Copilot Enterprise Search that lets an attacker silently exfiltrate sensitive data — including MFA/security codes, email messages, meeting details, SharePoint documents, and OneDrive files — from a victim through a single click of an unsuspicious link. Microsoft remediated the issue under CVE-2026-42824 and assigned it a maximum severity, critical rating.^[22][39][40]

Independent security-press coverage characterizes SearchLeak as a new attack that turns Microsoft 365 Copilot into a one-click data-theft tool, corroborating the product, impact, and single-click nature of the exploit.^[2][5]

The chain stitches together three individually limited weaknesses: a Parameter-to-Prompt (P2P) injection in which Copilot Enterprise Search's 'q' URL parameter is passed directly to Copilot as an executable prompt, an HTML rendering race condition in which an image tag in the AI response fires before the output sanitizer runs, and a Content-Security-Policy bypass via server-side request forgery in Bing's allowlisted image-search endpoint. Because the malicious link resolves to a trusted microsoft.com domain, conventional anti-phishing and URL-filtering tools do not flag it.^[22]

SearchLeak echoes the earlier EchoLeak flaw (CVE-2025-32711), a zero-click prompt-injection vulnerability in M365 Copilot disclosed by Aim Labs and patched in June 2025, which similarly abused Copilot's data access and CSP-allowlisted proxies to exfiltrate data. Together the two cases show how classic, normally containable web bugs become potent, hard-to-detect exfiltration paths once prompt injection is possible inside an AI assistant. Microsoft has fixed SearchLeak, so no user action is required to mitigate this specific vulnerability.^[22][0][3]

Attack chain

1. Delivery — crafted single-click link: A victim operating inside a Copilot Enterprise tenant clicks a specially crafted link that launches Microsoft 365 Copilot Enterprise Search. The link points to a trusted microsoft.com domain, so anti-phishing and URL-protection tools do not filter it, and no second click is needed.^[22]
2. Stage 1 — Parameter-to-Prompt (P2P) injection: The 'q' URL parameter accepted by Copilot Enterprise Search is passed directly to Copilot as an executable prompt, causing Copilot to search the victim's mailbox, calendar, and indexed organizational content and to format the retrieved data.^[22]
3. Stage 2 — HTML rendering race condition: An HTML image tag in the AI response fires before the output sanitizer kicks in, allowing an attacker-controlled image request to execute during response rendering.^[22]
4. Stage 3 — CSP bypass via Bing SSRF: Bing's image-search endpoint, which is allowlisted in the Content Security Policy, performs a server-side fetch to an attacker-controlled URL, bypassing CSP and acting as an unwitting exfiltration proxy.^[22]
5. Exfiltration: The victim's data, carried in the fetched request, ends up on the attacker's server — extracting emails, calendar entries, security codes, and indexed organizational content without alerting the user.^[22]

Disclosure timeline

How it works

SearchLeak abuses the fact that Microsoft 365 Copilot Enterprise Search passes the 'q' URL parameter directly to Copilot as an executable prompt (Parameter-to-Prompt injection). A crafted link can therefore instruct Copilot to search the victim's mailbox, calendar, SharePoint, and OneDrive and to format the retrieved content without the victim typing anything.^[22]

The retrieved data is exfiltrated via an HTML rendering race condition: an image tag in the AI response fires before Copilot's output sanitizer neutralizes the markup, triggering an outbound request during rendering.^[22]

The outbound fetch is routed through Bing's image-search endpoint, which is allowlisted in Copilot's Content Security Policy. Because Bing performs the server-side request (SSRF) to the attacker-controlled URL, the request bypasses the CSP allowlist and delivers the embedded stolen data to the attacker's server.^[22]

The technique parallels the earlier EchoLeak flaw, which likewise chained a prompt-injection classifier bypass, reference-style Markdown link/image redaction bypass, and abuse of a CSP-allowlisted Microsoft proxy (Teams content URL API) to auto-fetch attacker infrastructure and leak data.^[0]

Affected versions and patch status

Key takeaways

• Familiar, normally containable web bug classes like SSRF and HTML injection race conditions can be weaponized into high-impact, silent data-exfiltration attacks once prompt injection is available in an AI assistant's context.^[22]
• Trusted-domain delivery matters: because the SearchLeak link pointed to microsoft.com, conventional anti-phishing and URL-filtering defenses did not flag it, showing that AI-integrated products expand the attack surface beyond what traditional controls inspect.^[22]
• AI features that pass URL parameters directly into model prompts (Parameter-to-Prompt injection) create new pathways to exploit older bug classes in contexts where they previously had limited impact.^[22]
• SearchLeak is part of a recurring pattern of M365 Copilot exfiltration flaws (alongside EchoLeak/CVE-2025-32711) that abuse CSP-allowlisted Microsoft proxies to route stolen data out, indicating this is a structural weakness in RAG/agent designs rather than a one-off bug.^[22][0]

Defensive actions

• Confirm Microsoft's CVE-2026-42824 remediation is in effect across affected Copilot Enterprise tenants.: Microsoft fixed the vulnerability, and once the fix is applied no user action is required to mitigate this specific threat.^[22][39]
• Review how Microsoft 365 is connected to the wider environment and constrain the organizational content indexed and surfaced by Copilot Enterprise Search.: Because SearchLeak targets the Enterprise tier, the blast radius covers any content the user can access and could extend further depending on M365 connectivity.^[22]
• Treat single-click links to trusted vendor domains such as microsoft.com as potential exfiltration vectors, and monitor AI-assistant behaviors that combine prompt injection with outbound rendering (such as image tags fetching external URLs).: The SearchLeak link resolved to a trusted microsoft.com domain that bypassed anti-phishing controls, and classic bugs such as SSRF and HTML injection race conditions become potent, hard-to-detect exfiltration paths when prompt injection is available.^[22]
• For AI/RAG assistants generally, sanitize or quarantine untrusted input before it reaches the model, enforce least-privilege data access and DLP/sensitivity labels, and tighten CSP allowlists and automatic image-loading controls.: The closely related EchoLeak case showed prompt injection combined with CSP-allowlisted proxies enabling silent data leakage, and defenders were advised to constrain the model's field of view and monitor output for hidden references and suspicious outbound URLs.^[0]

Changelog

• Previously single-source (Varonis-only) claims about the SearchLeak one-click Copilot exploit and its CVE-2026-42824 remediation are now independently corroborated by security-press coverage (BleepingComputer, The Hacker News) and the NVD CVE record.^[2][5][40]
• Added comparative context linking SearchLeak to the earlier M365 Copilot prompt-injection exfiltration flaw EchoLeak (CVE-2025-32711), patched June 2025, establishing a recurring structural weakness in Copilot's handling of untrusted input and CSP-allowlisted proxies.^[0][3][41]