Disclosed vulnerability
SearchLeak: one-click exfiltration of mail, MFA codes and files from Microsoft 365 Copilot Enterprise Search
AIR-2026-0132 AIR record · 2026-06-microsoft-searchleak
From the supporting source
CSP Bypass via Bing SSRF: Bing's image-search endpoint, allowlisted in the Content Security Policy, performs a server-side fetch to an attacker-controlled URL.varonis.com
The record
Disclosed
2026-06-09
Vendor
Microsoft
Product
Microsoft 365 Copilot (Enterprise Search)
Risk domain
Privacy › Data exfiltration channels
System type
Generative model
Who acted
Agent acted — Copilot searched the mailbox and fetched the exfiltration image
Attack surface
Enterprise assistant
Autonomy level
Assistant
Initial vector
Url parameter prompt injection
Impact type
Data exfiltration, Mfa bypass
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI02 – Tool Misuse and Exploitation
- MITRE ATLAS
- AML.T0024 – Exfiltration via AI Inference API
- NIST AI RMF
- MAP 4.2
- EU AI Act
- Article 10
- ISO/IEC
- TR 24028; 23894
- AIUC-1
- A. Data & Privacy
- Scope
- tool misuse
- Mitigation
- Monitor network traffic for anomalous patterns; Restrict egress destinations.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
Microsoft 365 Copilot Enterprise tenants; victim only had to click a genuine microsoft.com link
Capability abused
Defense & remediation
Recorded defense
Copilot output sanitizer and Content Security Policy
Guardrail kinds
Output filter
Guardrail outcome
Silent
Fix shipped
Microsoft remediated server-side under CVE-2026-42824 (max severity critical); no customer action required
Taxonomy & references
Curator notes
Varonis Threat Labs. Three chained flaws: (1) Parameter-to-Prompt injection where the URL q parameter in Copilot Enterprise Search is passed to Copilot as an executable prompt, (2) an HTML rendering race condition where an <img> tag fires before the output sanitizer, (3) a CSP bypass via Bing SSRF. Proof of concept only; no observed exploitation. CVSS reporting is inconsistent across sources (Microsoft 6.5, NVD 7.5, Tenable 7.8) despite the 'critical' label; treat severity claims with care. date_disclosed reflects the June 2026 publication window; the exact day was not verified.
Supporting sources
Cite as
Enkrypt AI. "SearchLeak: one-click exfiltration of mail, MFA codes and files from Microsoft 365 Copilot Enterprise Search". AIR, AIR-2026-0132. https://agentincident.vercel.app/i/AIR-2026-0132/ (accessed 2026-10-19).