Security guardrails for Large Language Models (LLMs) face an ongoing uphill battle, and Microsoft just had to patch a glaring hole in its own defensive wall. Security researchers from Varonis Threat Labs recently disclosed a max critical vulnerability within the M365 Copilot AI platform. Dubbed SearchLeak, this clever exploit chain could allow an outside attacker to siphon off sensitive internal data—including active two-factor authentication (2FA) codes, emails, and corporate files—with nothing more than a single user click.
According to a technical breakdown by Varonis, (via ArsTechnica), the issue bypassed standard anti-phishing filters because the attack was delivered through a completely legitimate, trusted Microsoft domain link. Once clicked, the underlying AI logic essentially inherited the victim’s own access permissions, executing backend data collection silently in the background.
How the “SearchLeak” exploit worked with Microsoft’s Copilot
The root cause boils down to a fundamental weakness in consumer and enterprise AI products. That is, bots struggle to distinguish between legitimate user commands and a malicious instruction hidden within third-party text. In this case, Varonis engineered what they call a Parameter-to-Prompt Injection.
The attackers crafted a specific Microsoft 365 Copilot Search URL that included malicious code right inside the standard query field. When a user clicked the link, Copilot didn’t just search the term; it read the query as a direct order. The AI was instructed to scan the victim’s inbox, grab confidential items like email titles or authentication codes, and sneakily embed that data into a hidden image tag.
Outsmarting the guardrails
Microsoft built defenses to stop Copilot from sending outbound web requests to unverified domains to prevent data theft. However, the researchers discovered two major gaps in that armor.
First, a rendering race condition allows the browser to render Copilot’s response stream in real-time before Microsoft’s clean-up script finishes executing. By the time the security code sanitizes the page, the malicious image request has already left the building. Second, as Copilot naturally trusts other Microsoft properties like Bing, the exploit embedded the stolen data into a Bing “Search by Image” link. Bing’s own servers then fetched the image. This effectively acted as an accidental proxy that carried the data straight to the attacker’s server logs.
What was at stake?
The stakes for this kind of vulnerability are incredibly high in corporate environments. An automated script scraping attacker logs could easily grab active multi-factor authorization codes or password reset links. It would allow bad actors to breach an enterprise account before anyone realizes what happened. It also exposed indexed business files sitting on connected OneDrive or SharePoint repositories.
Fortunately, the tech giant mitigated the issue directly on its backend right after receiving the Varonis report. Because Copilot Enterprise operates as a fully managed service, administrators do not need to apply manual software updates or adjust local settings to protect their infrastructure.
The post Microsoft Fixes Critical Copilot Flaw That Allowed Remote Email Hijacking with One Click appeared first on Android Headlines.
