Case copilot-searchleakPrompt injectionUnited States
SearchLeak: one-click chain in M365 Copilot Enterprise Search exfiltrates data via Bing
Varonis Threat Labs chained prompt injection, a rendering race condition and SSRF through Bing so one crafted link made Copilot fetch sensitive data and embed it in an image request. Microsoft fixed it server-side.
HighAttack on AIStatus: PatchedVerified case file
Open in the interactive mapCite this case
- Reported
- Jun 15, 2026
- Location
- United States
- Target
- Microsoft 365 Copilot Enterprise Search
- Severity
- High
- Triggered by
- Varonis Threat Labs
- Actor type
- Security researchers
- Reported loss
- None reported
- CVE
- CVE-2026-42824
What happened
Varonis Threat Labs chained prompt injection, a rendering race condition and SSRF through Bing so one crafted link made Copilot fetch sensitive data and embed it in an image request. Microsoft fixed it server-side.
Impact: One-click theft of enterprise data accessible to the victim's Copilot; no in-the-wild abuse reported
Who triggered it
Actor: Varonis Threat Labs
Attribution: Responsible disclosure to Microsoft; no exploitation reported
Motive: Security research
How it happened
Attack vector: Crafted link carrying injected instructions; SSRF via Bing to bypass egress controls; image tag exfiltration
Root cause: Enterprise Search trusted link-supplied text and rendered attacker-controlled image URLs
Timeline
- Microsoft deploys server-side fix
- Varonis publishes SearchLeak
Response
Microsoft patched on its servers; no customer action required
Current status: Patched
Sources (open in a new tab)
- Dark Reading darkreading.com
- BeyondMachines beyondmachines.net
- Penligent penligent.ai
Cite this case
SearchLeak: one-click chain in M365 Copilot Enterprise Search exfiltrates data via Bing. AI Threat Watch, case copilot-searchleak, Jun 15, 2026. https://aithreat.io/cases/copilot-searchleak/
Permanent link: https://aithreat.io/cases/copilot-searchleak/