u/varonis-threat-labs

The latest discovery from Varonis Threat Labs highlights how Copilot Personal snitched on itself to let threats know where vulnerabilities lied.

Our threat research team just published SearchLeak, a critical vulnerability chain in Microsoft 365 Copilot Enterprise that lets an attacker steal emails, MFA codes, calendar details, and private org files with a single click on a legitimate microsoft.com link. No plugins, no authentication, no second interaction.

The attack chains an AI-native bug (a crafted URL query parameter that Copilot interprets as executable instructions) with a sanitizer race condition and an SSRF through Bing that routes stolen data off-network before the page's CSP can block it. Microsoft patched it at critical severity under CVE-2026-42824, but the broader takeaway is the pattern. AI doesn't just create new attack surfaces; it creates new paths into previously unexploitable vulnerability classes.

Full technical breakdown here: https://www.varonis.com/blog/searchleak

Varonis Threat Labs just published research on a three-stage vulnerability chain in Microsoft 365 Copilot Enterprise Search that we're calling SearchLeak (CVE-2026-42824, patched by Microsoft at critical severity). One click on a legitimate microsoft.com link is all it takes to silently exfiltrate emails, OTPs, MFA codes, calendar details, and private organizational files from a victim's M365 environment. No plugins. No special permissions. No second interaction.

How it works: The chain starts with a relatively new AI-native attack class known as Parameter-to-Prompt (P2P) injection, where a crafted URL's query parameter gets interpreted by Copilot as executable instructions rather than a search string. P2P is then combined with two classic web flaws: an HTML injection race condition that fires before Microsoft's output sanitizer can intervene, and an SSRF through Bing's image search endpoint that bypasses the page's Content Security Policy entirely. Each vulnerability on its own is manageable. Chained together, they hand an attacker everything the victim can access inside the organization.

Why this matters: Copilot Enterprise operates with the user's full graph permissions, so there's no blast radius ceiling. An attacker inherits the victim's access to the entire organization's indexed content, including sensitive info like earnings reports, employee salary data, acquisition plans, internal communications, etc., all without ever authenticating. The attack link routes through microsoft.com, so phishing filters and URL protection tools don't flag it.

What makes SearchLeak worth paying attention to as a broader trend is what the AI component actually does here. The SSRF and the race condition are well-documented vulnerability classes. They've existed for years. But without the P2P injection, neither of those bugs is reachable in this context. AI doesn't just introduce novel attack surfaces. AI is creating new paths into previously unexploitable old ones. This is the second time we've seen this pattern after Reprompt in Copilot Personal, and it won't be the last.

Full technical breakdown with attack flow diagrams and videos here: https://www.varonis.com/blog/searchleak