Copilot Flaw Turned AI Into Data Exfiltration Tool

Researchers disclosed SearchLeak, a Microsoft 365 Copilot Enterprise vulnerability chain that reportedly let a single crafted-link click turn a user’s AI assistant into a tool for collecting and sending out sensitive data. The attack abused prompt injection and trusted Microsoft infrastructure, making the activity appear similar to normal AI-assisted work.

Key findings

• The SearchLeak chain reportedly required one victim click on a crafted Microsoft 365 Copilot Search URL.
• Attacker-controlled instructions embedded in a URL parameter could cause Copilot to retrieve emails, MFA codes, calendar events, and private files.
• The chain allegedly used Bing server-side request forgery (SSRF) to send data through a trusted Microsoft domain, helping the traffic blend in with normal activity.
• Microsoft reportedly patched the vulnerability on June 4 with a server-side fix that required no user action.
• The article argues that enterprise AI assistants should have separately governed access policies rather than automatically inheriting all user permissions.

Who’s being targeted

• Commonly targeted roles: All Microsoft 365 Copilot Enterprise users, Executives and executive assistants, IT and security teams, Data governance teams, Owners of sensitive data repositories.
• Affected industries: Organizations using Microsoft 365 Copilot Enterprise, Information and Media, Professional Services, Finance and Insurance, Healthcare, Government, Education.
• Attack channels: email, website.
• Impersonated: Microsoft 365 Copilot Search or an internal colleague sharing a Copilot search result.

Awareness takeaways

• Treat unexpected Copilot Search links as you would any other unsolicited work link: verify the sender and purpose before opening them, and use the normal Microsoft 365 interface when possible.
• Do not assume that a link is safe simply because it uses a trusted Microsoft domain or opens an approved enterprise AI tool.
• Keep AI services patched and confirm whether security fixes are applied, even when the vendor says no user action is required.
• Limit what AI assistants can retrieve from sensitive repositories, especially authentication information, private files, and highly sensitive email content.

Red flags to watch for

• An unexpected Copilot or Microsoft 365 search link arrives without context.
• The sender pushes the recipient to open a link rather than navigate to Copilot normally.
• The link contains unusual or lengthy URL parameters.