SearchLeak: How One Click Turns Microsoft 365 Copilot Into a Full Data Exfiltration Tool

Published: September 04, 2026 | Author: RedSheep Reports

A single URL click. That's all it took to drain a victim's mailbox, OneDrive files, SharePoint documents, and calendar entries through Microsoft 365 Copilot Enterprise. Varonis Threat Labs disclosed SearchLeak (CVE-2026-42824) earlier this summer, chaining three individually minor weaknesses into a one-click data exfiltration path [1][2]. Microsoft remediated the flaw server-side prior to Varonis's public disclosure in mid-June 2026 and assigned it a maximum severity rating of "critical," despite a CVSS score of only 6.5 (medium) [1][2]. No user action was required for the patch.

The attack was invisible to the victim. From their perspective, Copilot appeared to "think" briefly, with no visual indication that data was being siphoned to attacker infrastructure [2]. Security teams already struggle to keep pace: research cited alongside the disclosure notes that organizations detect a limited fraction of successful attacks [2]. SearchLeak sits in the gap between what AI assistants can access and what security tooling can actually monitor.

The Vulnerability Chain: Three Flaws, One Kill Path

Varonis researcher Dolev Taler identified and combined three individually insufficient flaws into SearchLeak [1][2]:

1. Parameter-to-Prompt (P2P) Injection

The attack begins with the q URL parameter on a legitimate microsoft.com domain. An attacker crafts a URL that injects instructions directly into Copilot's processing context through this parameter [1][2]. Because the URL points to a real Microsoft domain, traditional URL reputation filters and anti-phishing controls have no reason to flag it.

2. HTML Rendering Race Condition

Copilot's response rendering includes a sanitizer designed to strip dangerous HTML elements. The second flaw exploits a race condition: an <img> tag fires before the sanitizer catches and removes it, creating a brief but exploitable window for outbound data exfiltration [1][2].

3. Content Security Policy Bypass via Bing SSRF

Even with an executable HTML tag, Content Security Policy (CSP) restrictions should block connections to external domains. SearchLeak bypasses this through a server-side request forgery (SSRF) routed through Bing, a trusted Microsoft domain already permitted by the CSP [1][2]. The exfiltrated data rides out through infrastructure the browser considers safe.

What Gets Stolen

Copilot Enterprise holds privileged read access to the authenticated user's entire M365 data set by design. SearchLeak weaponizes that access. Exfiltrated data could include [2]:

• Email content, including MFA codes and passwords sent via email
• Calendar events and meeting details
• SharePoint documents accessible to the user
• OneDrive files

All of this happens through a single crafted URL click. The victim sees nothing unusual. No file download prompts, no permission dialogs, no visible network activity.

The Scoring Disconnect

Microsoft labeled SearchLeak with its maximum severity rating of "critical," yet the vulnerability received a CVSS score of 6.5 - a medium-severity rating [1][2][4]. This disconnect matters because organizations relying on CVSS thresholds to drive patching speed would classify a 6.5 as routine, despite the vulnerability enabling single-click exfiltration of an entire mailbox and document library. Defenders should weight their response toward the practical impact rather than the numeric CVSS score alone.

A Recurring Pattern in AI-Augmented Platforms

SearchLeak was not the first major Copilot exfiltration vulnerability. Varonis noted that SearchLeak follows their related discovery of "Reprompt," a vulnerability affecting Microsoft Copilot that also exploited the q URL parameter for prompt injection [1][5]. The pattern is clear: AI assistants that require broad data access permissions to function create a concentrated point of failure. Every vulnerability in the AI layer becomes an automatic bulk exfiltration path because the assistant already has read access to everything.

Traditional data loss prevention (DLP) controls were built for a world where data moves through known channels: email attachments, cloud storage uploads, USB transfers. An AI intermediary that can read everything in a user's M365 tenant and compress it into a single outbound request via a trusted first-party domain breaks those assumptions entirely.

MITRE ATT&CK Mapping

The sources do not explicitly map SearchLeak to MITRE ATT&CK technique IDs. Based on the described attack chain, the following techniques are directly applicable:

Note on prompt injection: Prompt injection does not currently have a direct MITRE ATT&CK technique mapping. The MITRE ATLAS framework covers this under AML.T0051 (LLM Prompt Injection). Organizations building detection logic for AI-native attacks should consider incorporating ATLAS alongside ATT&CK.

Detection and Hunting

SearchLeak was patched server-side by Microsoft, but the detection challenge extends beyond this single CVE. The broader class of Copilot prompt injection attacks demands proactive hunting.

What to look for:

• Copilot activity logs in Microsoft Purview: Search for unusual Copilot interactions, particularly those initiated via URL parameters rather than manual user prompts. Look for Copilot sessions that access abnormally large volumes of data across multiple M365 services in a single interaction.

• Outbound requests from Copilot to Bing endpoints: The SSRF component routed exfiltrated data through Bing. Monitor for unusual patterns in requests to Bing domains originating from Copilot sessions, particularly those carrying encoded payloads or unusually large query strings.

• URL parameter anomalies: Hunt for inbound URLs containing the q parameter with encoded or obfuscated prompt injection payloads directed at Copilot endpoints.

• Unified Audit Log (UAL) queries: Search for Copilot interaction events correlated with large-scale FileAccessed or MailItemsAccessed events in a compressed timeframe.

// KQL query for Microsoft Sentinel: Copilot sessions with high-volume data access
// NOTE: Verify exact Copilot operation names in your tenant's UAL schema.
// "CopilotInteraction" is illustrative; Microsoft may use different event names.
OfficeActivity
| where TimeGenerated > ago(7d)
| where Operation in ("CopilotInteraction", "FileAccessed", "MailItemsAccessed")
| summarize AccessCount = count(), DistinctOperations = dcount(Operation) by UserId, bin(TimeGenerated, 5m)
| where AccessCount > 50 and DistinctOperations >= 2
| sort by AccessCount desc

Sigma Rule (conceptual, for environments ingesting M365 audit logs):

title: Suspicious High-Volume Copilot Data Access
id: a3c7e1f0-9b24-4d8a-b6f2-3e5a7c8d1b09
author: RedSheepSec
status: experimental
logsource:
  product: m365
  service: audit
detection:
  selection:
    Operation|contains: 'CopilotInteraction'
  condition: selection
falsepositives:
  - Legitimate heavy Copilot usage by power users
level: medium

Analysis

The core design tension behind SearchLeak is not going away. Microsoft built Copilot Enterprise to be useful, and usefulness requires broad read access to the user's data. Every prompt injection or rendering flaw in the Copilot pipeline becomes an instant exfiltration primitive because the access is already there. The attacker does not need to escalate privileges or move laterally. Copilot has already done that work.

The fact that the attack URL sat on a legitimate microsoft.com domain is particularly consequential for defenders. URL reputation lists, domain-based email filtering, and even user training ("check the domain before you click") all fail when the malicious link points to a first-party Microsoft endpoint. This collapses a major layer of defense that organizations have spent years building.

Copilot audit logging is not enabled by default in many tenants, and few security teams have built detection logic around AI assistant behavior. Organizations without Copilot-specific audit logging enabled would likely have limited ability to detect or investigate this attack even post-incident.

References

1. Varonis Threat Labs: SearchLeak: How We Turned M365 Copilot Into a One-Click Data Exfiltration Weapon
2. BleepingComputer: New attack turned Microsoft 365 Copilot into 1-click data theft tool
3. Dark Reading: Copilot 'SearchLeak' Attack Allows 1-Click Data Theft
4. Dark Reading: Copilot 'SearchLeak' Attack Allows 1-Click Data Theft (CVSS 6.5 detail)
5. Varonis Threat Labs: Reprompt: The Single-Click Microsoft Copilot Attack