Microsoft 365 Copilot, an AI-powered assistant, has recently been exploited in a sophisticated attack chain dubbed SearchLeak. This vulnerability chain, as developed by researchers at Varonis, showcases how AI systems can be weaponized to steal sensitive data from users' mailboxes, OneDrive, and SharePoint accounts. The attack leverages three distinct flaws, each individually insufficient for a meaningful attack, but when combined, they create a potent data theft tool.
The first stage of the attack involves a parameter-to-prompt (P2P) injection weakness. Microsoft 365 Copilot Search accepts the 'q' URL parameter for search queries, which can be manipulated to instruct Copilot to search for specific data and extract it. For instance, an attacker can craft a URL that tells Copilot to search the victim's emails, extract the title, and embed it in an image URL. This allows the attacker to steal sensitive information without the victim even typing anything.
The second stage exploits an HTML rendering race condition. Raw HTML is temporarily rendered by the browser before it is wrapped in code blocks, allowing attacker-controlled HTML with an tag to execute and trigger outbound requests before the sanitization process completes. This enables the attacker to fetch stolen data from their endpoint.
The third part of the chain is an SSRF issue in Bing's 'Search by Image' feature. This feature is used to launch a request to fetch an image from the attacker's endpoint, bypassing content-security-policy (CSP) protection. By making the request appear as if it's coming from Bing, the attacker can read the stolen data from their server's request logs.
The attack chain starts with the victim clicking on a crafted link, which launches Microsoft 365 Copilot Search with instructions in the 'q' parameter. Copilot then generates a response with an image tag, including the stolen information in the URL. While the response is being streamed, the browser renders the image and sends a request to Bing, which fetches the attacker's URL, including the sensitive data. From the victim's perspective, the data exfiltration appears as a normal Copilot search process.
Microsoft has addressed the SearchLeak vulnerability by assigning it the CVE-2026-42824 identifier with a critical severity rating. The fix does not require any user action, but it highlights the importance of testing every layer of security to prevent such attacks. Varonis emphasizes that familiar bugs like SSRF and HTML injection race conditions can be weaponized when prompt injection is possible, and AI systems have created new pathways for exploiting older vulnerabilities.
This incident underscores the need for security teams to improve their detection capabilities. According to the Picus whitepaper, only 14% of successful attacks are alerted on, while the rest move through the environment unseen. Breach and attack simulation tests are crucial to identifying and mitigating threats before they cause significant damage.
