SearchLeak: How We Turned M365 Copilot Into a One-Click Data Exfiltration Weapon

Source: Varonis Blog

Author: Dolev Taler

URL: https://www.varonis.com/blog/searchleak

ONE SENTENCE SUMMARY:

SearchLeak chained P2P prompt injection, streaming HTML race, and Bing SSRF to silently exfiltrate Microsoft 365 Copilot Enterprise data via one click.

MAIN POINTS:

1. Varonis found a three-stage chain weaponizing Copilot Enterprise Search for covert data theft.
2. Parameter-to-Prompt Injection lets the URL q parameter become executable Copilot instructions.
3. Enterprise Search’s focus on organizational content makes it ideal for harvesting sensitive business data.
4. Attack requires only one click on a trusted microsoft.com link—no plugins or permissions.
5. A streaming-phase HTML rendering race allows <img> requests before output sanitization.
6. Post-processing <code> wrapping occurs too late; the browser already emitted the outbound request.
7. CSP blocks direct attacker domains, but *.bing.com is allowlisted for images.
8. Bing’s “search by image” endpoint server-fetches attacker URLs, acting as an SSRF proxy.
9. Exfiltration is achieved by embedding stolen mailbox content into the image URL path.
10. Microsoft patched as CVE-2026-42824, rated critical, highlighting AI-enabled chaining of classic bugs.

TAKEAWAYS:

1. Treat AI query parameters as potential instruction channels, not merely search input.
2. Apply sanitization during streaming/render time, not after model output completion.
3. Audit CSP allowlists for endpoints that perform server-side URL fetches.
4. Detect suspicious Copilot Search URLs containing encoded HTML tags or exfiltration prompts.
5. User awareness matters: long encoded Microsoft links and unsolicited Copilot searches warrant reporting.