Microsoft’s biggest AI sales pitch has been trust: point Copilot at your inbox, your SharePoint library, and your calendar, and let it search everything at once. On June 15, 2026, Varonis Threat Labs published the flip side of that pitch. Researchers had found a way to turn that same search index into a data pipe for attackers, triggered by nothing more than a single click on what looked like an ordinary Microsoft link. The bug, dubbed SearchLeak and tracked as CVE-2026-42824, chained three separate flaws in Microsoft 365 Copilot Enterprise Search into one exfiltration path: prompt injection, a rendering race condition, and a server-side request forgery riding on Bing’s own infrastructure. Microsoft has since patched the issue on its servers, and no vendor has reported it being used in a real attack. But SearchLeak lands in the middle of a crowded run of 2026 Copilot disclosures: Microsoft confirmed CVE-2026-26133 on January 28, 2026, with Permiso Security tracking mitigations that ran from February 17 to March 11, 2026, and the Cloud Security Alliance flagged CVE-2026-24299, reserved that same January and not publicly disclosed until March 2026, leaving affected Copilot tenants exposed for roughly two months. The run didn’t stop with SearchLeak, either: NVD logged CVE-2026-50517, a deserialization flaw in M365 Copilot, on July 24, 2026, with Microsoft itself listed as the CVE Numbering Authority. Coming almost exactly a year after EchoLeak, a separate zero-click Copilot bug, the pattern is forcing a hard question on enterprise security teams: can an AI assistant with standing access to everything ever be secured against attacks that only need to talk to it?
Don't miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
What Is SearchLeak? Breaking Down CVE-2026-42824
SearchLeak is the name Varonis Threat Labs gave to a vulnerability chain it discovered in Microsoft 365 Copilot Enterprise Search, the AI-powered search layer that lets Copilot pull answers from a user’s email, calendar, Teams messages, SharePoint sites, and OneDrive files. The National Vulnerability Database tracks the underlying flaw as CVE-2026-42824, first published on June 4, 2026, and updated on June 19. NVD’s own description is short: missing authentication for a critical function in M365 Copilot, allowing an unauthorized attacker to disclose information over a network.
Varonis’s technical write-up, published June 15, fills in what that means in practice. A victim only had to click a single Copilot Enterprise Search link, one pointing to a legitimate Microsoft domain, for Copilot to start acting on attacker-supplied instructions hidden inside the link itself. From there, Copilot would search whatever content the victim already had permission to see, then quietly ship it back to the attacker using Microsoft’s own infrastructure as the delivery truck. No malware, no phishing attachment, no stolen credentials. Just a link, structured a specific way, aimed at a feature built to be helpful.
The Three-Stage Attack Chain, Explained
The interesting part isn’t that any single piece of SearchLeak was new. It’s that Varonis chained three known bug classes into one repeatable path.
The first stage is what researchers called parameter-to-prompt injection. Copilot Enterprise Search accepts a query through a URL parameter, reported by BleepingComputer as the “q” parameter. Instead of a normal search term, an attacker could embed text formatted to resemble an instruction. Copilot’s underlying model doesn’t reliably separate “what the user typed” from “what showed up in the URL,” so it followed the embedded instruction as though the user had typed it.
The second stage is a rendering race condition. When Copilot returned results, a brief window existed where injected HTML could execute before Microsoft’s content security policy fully applied. That window was enough to trigger an outbound request.
The third stage is where the exfiltration actually happens: a server-side request forgery routed through Bing’s “Search by Image” feature. Because Bing’s domains sit on Microsoft’s own allowlist, the outbound data transfer looked, to any enterprise data-loss-prevention tool watching the network, like ordinary traffic to a trusted Microsoft domain. That’s the detail that alarmed researchers most. The attack never needed to break out of Microsoft’s ecosystem to succeed. It used Microsoft’s own trusted infrastructure as the exit door.
Here is the conceptual shape of the flaw, illustrated only at a structural level, with no working payload:
Normal Copilot Enterprise Search request:
https://[copilot-search-endpoint]/search?q=quarterly+sales+report
Conceptual structure of a parameter-to-prompt attack (illustrative only):
https://[copilot-search-endpoint]/search?q=[text styled to read as a
system instruction rather than a search term, directing Copilot
to render a follow-up image request pointed at an attacker path]Each stage on its own is a known bug class that security teams already test for individually. Chained together against a feature with standing access to a mailbox, they add up to something new:
| Stage | Vulnerability Class | Mechanism | Control Bypassed |
|---|---|---|---|
| 1 | Parameter-to-prompt injection | Attacker text in the search URL’s query parameter is read as an instruction, not a search term | Input/instruction separation |
| 2 | HTML rendering race condition | Injected HTML executes in a brief window before the content security policy fully applies | Content Security Policy (CSP) |
| 3 | SSRF via Bing “Search by Image” | Exfiltrated data rides an outbound request through Bing’s image-search infrastructure, a domain already allowlisted | DLP / network allowlisting |
What Data Attackers Could Reach
Because Copilot Enterprise Search operates with the clicking user’s own permissions, SearchLeak was a disclosure bug, not a privilege-escalation bug. An attacker never gained access to more than the victim already had. For an employee with broad access, that’s still a lot. Varonis’s write-up and subsequent coverage list emails, meeting and calendar details, Teams messages, SharePoint documents, and OneDrive files as exposed content, along with any multi-factor authentication codes or password-reset links sitting in a user’s inbox at the time. The theme of over-broad but technically “permitted” access isn’t unique to SearchLeak: the BBC reported on February 19, 2026, that Microsoft had separately acknowledged a Copilot bug exposing confidential email content, describing it the same way, as users seeing content they already had rights to see, rather than a straightforward privilege-escalation flaw. That underlying oversharing problem is bigger than any single bug: Concentric AI’s April 2026 data-risk report found that 16% of business-critical data across the average enterprise is overshared internally, averaging roughly 802,000 files per organization sitting within reach of more employees, and by extension more AI assistants, than intended.
That last detail matters more than it looks at first glance. An MFA code is normally useful for seconds. But SearchLeak’s exfiltration happened automatically the moment a victim clicked, and Copilot’s search index doesn’t distinguish between a sales deck and a one-time passcode. Both are just indexed text to a model told to go retrieve something.
Timeline: From Silent Patch to Public Disclosure
SearchLeak followed the pattern security researchers call coordinated disclosure. NVD’s record shows the CVE was published on June 4, 2026, several days before the technical detail became public. Varonis’s own blog post, dated June 15, laid out the full attack chain for the first time, and Microsoft’s fix was already live by the time the details came out. Coverage from The Hacker News and BleepingComputer both note the patch was applied server-side, rolling out through Microsoft’s cloud infrastructure rather than a Patch Tuesday update that IT departments had to schedule themselves.
No enterprise customer needed to install anything. As of the most recent public reporting, no security vendor has documented the flaw being used in a real attack. That puts SearchLeak in the same category as EchoLeak a year earlier: a serious, responsibly disclosed research finding, not an active outbreak.
Why the CVSS Score Depends on Who You Ask
Ask three sources for SearchLeak’s severity score and three different numbers come back. The Hacker News reported Microsoft’s own assessment at CVSS 6.5, while NVD’s enrichment puts it at 7.5. Tenable’s vulnerability database lists a base score of 7.8. Varonis and Microsoft both describe the bug qualitatively as Critical.
The gap isn’t a reporting error so much as a structural quirk of how CVSS and vendor severity ratings sit side by side. CVSS scores the technical mechanics of a flaw: what access it needs, how complex the attack is, what it compromises. Microsoft’s own severity labels (Critical, Important, Moderate, Low) weigh exploitability and real-world blast radius more heavily, which is how a chain that needs a single click to expose an entire mailbox gets labeled Critical by the vendor while landing in the mid-7s or lower on a strict numeric scale. For security teams building risk models around Copilot, the practical takeaway is simple. Don’t anchor entirely to one number. A one-click, no-malware data exfiltration path is a serious finding regardless of which CVSS calculator produced it.
Microsoft’s Response and the Cloud-Side Fix
Microsoft’s remediation for SearchLeak followed the same playbook it used for EchoLeak in 2025: fix it in the service, not on the endpoint. Because Copilot Enterprise Search runs as a hosted feature rather than installed software, Microsoft closed all three stages of the chain, the parameter injection, the rendering race, and the Bing-mediated SSRF route, without shipping a single update to a customer’s tenant.
That’s a real advantage over traditional on-premises vulnerabilities, where a critical CVE can sit unpatched for weeks while IT teams test and schedule updates. It’s also a structural risk in the other direction. When the vendor controls the entire patch cycle, customers have no visibility into how long a flaw existed before disclosure, and no ability to mitigate on their own timeline. Microsoft has not published a detailed account of exactly how long SearchLeak existed in production before Varonis found it, a gap independent researchers have flagged in coverage of the disclosure. As recently as August 2026, Microsoft’s own Copilot privacy page was still telling customers that adopting Copilot brings no changes to an organization’s existing security, compliance, or privacy posture, a claim that sits awkwardly next to a year that has already produced half a dozen named, CVE-tracked flaws across the product line.
SearchLeak vs. EchoLeak: How the Two Copilot Bugs Compare
SearchLeak isn’t Microsoft 365 Copilot’s first brush with prompt injection at scale. On June 11, 2025, Aim Security disclosed EchoLeak (CVE-2025-32711, CVSS 9.3), a zero-click flaw that let a single crafted email trigger data exfiltration with no user interaction at all, a finding Fortune’s coverage credited to Aim Security alongside NVD’s own record of the bug, which rated the flaw 9.3 out of 10 and stated no customer action was required. Researchers dubbed the underlying weakness an “LLM scope violation,” meaning the model was tricked into treating attacker content as trusted instructions, then acting on data the attacker never should have reached through that user. By June 2025, an arXiv research paper was already citing EchoLeak as the first real-world, zero-click prompt-injection exploit documented against a production Microsoft 365 Copilot deployment. Microsoft patched EchoLeak server-side in May 2025, before Aim’s public disclosure, and reported no evidence of in-the-wild exploitation, the same pattern now repeating with SearchLeak.
The two bugs share a root cause and differ on mechanics. Both rely on Copilot failing to separate trusted user intent from untrusted external content. Both were fixed silently in the cloud. Both were found by outside researchers rather than Microsoft’s own red team. Where they diverge is how much the victim has to do: EchoLeak needed nothing from the user, while SearchLeak needed one click. That makes EchoLeak the more severe bug on paper, and it’s part of why EchoLeak’s CVSS score sits nearly two points higher than even the highest SearchLeak estimate. But a one-click bar is not a high one inside a large enterprise, and SearchLeak’s use of trusted Microsoft infrastructure as its exfiltration channel arguably makes it harder for defenders to catch in the moment.
| Attribute | SearchLeak (CVE-2026-42824) | EchoLeak (CVE-2025-32711) |
|---|---|---|
| Disclosed by | Varonis Threat Labs | Aim Security |
| Disclosure date | June 15, 2026 | June 11, 2025 |
| User interaction required | One click on a crafted link | None (zero-click, via email) |
| Reported CVSS score | 6.5–7.8 (disputed across sources) | 9.3 |
| Microsoft severity rating | Critical | Critical |
| Attack vector | Parameter-to-prompt injection + rendering race + Bing SSRF | Indirect prompt injection via email content |
| Data exposed | Email, calendar, Teams, SharePoint, OneDrive, MFA codes | Internal files and data reachable in Copilot’s context |
| Patch method | Server-side, at/before public disclosure | Server-side, patched May 2025 before June disclosure |
| Confirmed in-the-wild exploitation | None reported | None reported |
The Bigger Pattern: Copilot’s Recurring Prompt-Injection Problem
Two named, critical-rated prompt-injection chains in Microsoft’s flagship AI assistant within twelve months isn’t a coincidence of bad luck, and it isn’t the whole count either. SentinelOne’s advisories log a string of related Copilot flaws stretching from 2025 into 2026: CVE-2025-53787, a Copilot BizChat information-disclosure bug that researcher ZeroPath said could expose BizChat data as early as August 2025, though it went publicly undisclosed until SentinelOne logged it April 15, 2026, exposing sensitive data to unauthorized users with no authentication required; CVE-2025-53774, a high-severity Copilot Chat disclosure bug tied to CWE-77 command injection, first published August 7, 2025 and re-tracked in SentinelOne’s advisory on April 22, 2026; CVE-2026-41614, an authentication-bypass flaw in Copilot for Desktop mapped to CWE-284 improper access control, published May 12, 2026; and CVE-2026-26137, a server-side request forgery bug in Copilot Business Chat capable of privilege escalation, reported March 20, 2026. It’s a structural symptom. Copilot’s entire value proposition rests on giving a language model broad, standing access to a user’s email, files, and calendar, then trusting the model to act only on the user’s real intent. Every piece of content Copilot touches, an email subject line, a file name, a URL parameter, a calendar invite, is a potential channel for instructions the model can’t reliably tell apart from the user’s own.
Security researchers have warned about this bug class since prompt injection was first formally described in 2022 and 2023, but EchoLeak and SearchLeak are among the first cases where the theoretical risk became a documented, working, silent exfiltration path against a mainstream product used across millions of corporate seats. For readers tracking the wider threat landscape, this pattern is part of a broader shift covered in our 2026 cybersecurity threats overview, where AI-adjacent risk has moved from a theoretical category to a line item in enterprise risk registers.
Why Trusted Domains Make DLP Blind
The detail security teams keep returning to is the SSRF stage. Most enterprise data-loss-prevention systems work by flagging traffic to unfamiliar or risky destinations. SearchLeak’s exfiltration never touched one. It rode through Bing, a domain every Microsoft 365 tenant already trusts by default. That’s the same structural weakness Kiteworks’ analysis of the disclosure flagged as the hardest part to defend against: a DLP stack built to watch destinations, not behavior, has nothing to catch here. It’s a gap Microsoft has had to revisit more than once in 2026: CybersecurityNews reported that a separate Copilot DLP-bypass advisory, tracked as CW1226324, was first flagged on February 4, 2026, with Microsoft beginning fixes on February 11, 2026, underscoring that trusted-domain blind spots in Copilot’s data-loss-prevention coverage predate SearchLeak’s June disclosure.
Market Impact: What This Means for Enterprise AI Budgets
SearchLeak didn’t move Microsoft’s stock, and no evidence suggests enterprise customers paused Copilot rollouts because of it. Both disclosures were patched before or shortly after going public, with no confirmed breach of a named customer tied to either bug. The market impact shows up less in headlines and more in how enterprise security budgets are shifting in 2026.
Security teams that once treated AI assistants as a productivity rollout, an IT and change-management problem, are increasingly treating them as a new attack surface requiring their own review process, the way mobile device management or cloud migration did a decade earlier. That shift carries a real cost. It means threat-modeling AI features before launch, running red-team exercises against prompt injection specifically, and in some cases restricting how much of a corporate file system an AI assistant can index by default. Vendors selling AI-specific security and data-loss-prevention tooling, built to monitor what an AI assistant does with the data it can see rather than just where its traffic goes, are positioned to benefit as enterprises look to close the exact visibility gap that let SearchLeak’s exfiltration blend into ordinary Microsoft network traffic.
How Rival AI Assistants Stack Up on This Risk
Copilot isn’t the only enterprise AI assistant with standing access to a company’s email, files, and calendars, and it isn’t the only one facing scrutiny over prompt injection. Google, Salesforce, and ServiceNow have all built comparable retrieval-augmented assistants into their enterprise suites, each facing the identical architectural problem: a model that has to treat untrusted external content and trusted user instructions as if they arrive through the same channel, because for the model, they do.
The difference so far is disclosure history. Microsoft’s Copilot has two named, CVE-tracked, publicly dissected prompt-injection chains within a year, largely because it’s the most widely deployed product of its kind and the most heavily scrutinized by outside researchers such as Aim Security and Varonis. That scrutiny cuts both ways. It means Copilot’s flaws get found and fixed in public, while a rival product with less research attention could be carrying an equivalent unpatched flaw with no CVE and no headline attached to it. For enterprise buyers, the right read isn’t “avoid Copilot.” It’s that any AI assistant wired into email, files, and calendars deserves the same adversarial testing before rollout, regardless of vendor.
A Short History of Prompt Injection Attacks
Prompt injection has gone from an academic curiosity to a named-CVE enterprise risk in under four years. Researchers first formally described the technique in 2022, pointing out that large language models struggle to separate a developer’s instructions from text supplied by a user or pulled from an external source. Early proof-of-concept attacks targeted chatbots and browser plugins, tricking them into ignoring their own guardrails, mostly as a research curiosity rather than a production threat.
EchoLeak’s Legacy: the “LLM Scope Violation”
The risk moved from academic to enterprise-critical in June 2025, when Aim Security’s EchoLeak became, by multiple accounts, the first widely reported zero-click prompt-injection exploit against a production enterprise AI assistant, requiring nothing more than a single email landing in a Copilot-connected inbox. SearchLeak, a year later, showed that even a fixed, hardened version of the same product could be re-exploited through a different combination of the same underlying weakness, this time needing one click instead of zero. The throughline across both cases: as AI assistants gain more standing access to enterprise data, the definition of attack surface expands to cover every piece of content that assistant will ever read, not just the software it runs on.
Industry Reaction to SearchLeak
Varonis Threat Labs, which found and disclosed the chain, positioned SearchLeak in its technical write-up as proof that Copilot’s own search feature could become a silent channel for pulling data out of an organization, since a victim sees nothing more than Copilot appearing to pause for a moment before returning results. Trade coverage from The Hacker News and BleepingComputer both emphasized the same point: the attack left no visible trace for the person who clicked the link, and nothing for network security tools to flag, since the outbound traffic never left Microsoft’s own trusted domains.
That combination, invisible to the user and invisible to the network monitor, is the detail security teams have focused on most in the weeks since disclosure, more than the CVSS score debate or the exact CVE number.
What Security Teams Should Do Now
Neither SearchLeak nor EchoLeak required customers to install a patch, but that doesn’t mean there’s nothing for security teams to act on. Coverage of both disclosures converges on a similar set of recommendations for organizations running Microsoft 365 Copilot Enterprise or any comparable AI assistant with broad data access:
- Audit exactly which data sources Copilot can index by default, and scope that access down to what each role actually needs instead of leaving broad default permissions in place.
- Treat AI assistant traffic as its own monitoring category, since SearchLeak’s exfiltration blended into normal Microsoft network traffic and wouldn’t have tripped a conventional DLP rule.
- Add prompt-injection scenarios to existing red-team and tabletop exercises rather than treating AI features as out of scope for security testing.
- Track vendor security advisories for AI products the way IT teams already track Patch Tuesday, even though most AI-assistant fixes ship silently with no traditional patch calendar entry.
- Avoid storing long-lived MFA codes and password-reset links in email, since both are now a documented target for exactly this kind of automated, click-triggered exfiltration.
None of this requires exotic tooling. It requires treating an AI assistant’s search index the way security teams already treat a database with broad read access: something that needs its own access review, its own monitoring, and its own place in the threat model.
5 Predictions for Agentic AI Security in 2026-2027
- More named, CVE-tracked prompt-injection chains are coming. EchoLeak and SearchLeak won’t be the last two. Expect at least one more disclosed against a major enterprise AI assistant, Microsoft’s or a competitor’s, within the next twelve months, as more independent researchers specialize in this bug class.
- CVSS will keep struggling to score these bugs consistently. Expect continued gaps between vendor severity labels and numeric CVSS scores for AI-specific vulnerabilities, pushing some researchers toward AI-specific severity frameworks that weigh standing data access rather than classic exploit complexity.
- Enterprise AI contracts will start requiring security disclosures. Expect large enterprise customers to push AI vendors, Microsoft included, for contractual commitments on vulnerability disclosure timelines and independent audits of retrieval features, similar to existing SOC 2 and FedRAMP terms.
- DLP vendors will race to close the trusted-domain blind spot. SearchLeak’s exfiltration hiding inside allowlisted Microsoft traffic is likely to drive a wave of data-loss-prevention products built to inspect AI assistant behavior rather than just network destination.
- Pressure will grow on Microsoft to detail its own AI red-teaming. After two major public disclosures from outside researchers in successive years, expect louder calls for Microsoft to show its internal red team is finding these bug classes before external researchers do, not after.
Frequently Asked Questions
What is SearchLeak?
SearchLeak is the name Varonis Threat Labs gave to a three-stage vulnerability chain in Microsoft 365 Copilot Enterprise Search, tracked as CVE-2026-42824, that let an attacker exfiltrate data from a victim’s Microsoft account after a single click on a crafted link.
Was SearchLeak exploited in the wild?
No security vendor has reported confirmed in-the-wild exploitation as of the most recent public coverage. It was found and disclosed by Varonis Threat Labs as a research finding, then patched by Microsoft.
Do I need to install a patch for SearchLeak?
No. Microsoft fixed the issue server-side within its cloud infrastructure, so no customer action, update, or configuration change was required.
What is the CVSS score for CVE-2026-42824?
Sources disagree. The Hacker News reported Microsoft’s own assessment at 6.5, NVD’s enrichment lists 7.5, and Tenable’s database shows a base score of 7.8. Microsoft and Varonis both describe the flaw qualitatively as Critical.
How is SearchLeak different from EchoLeak?
EchoLeak (CVE-2025-32711), disclosed by Aim Security in June 2025, required zero user interaction and was triggered by a single email. SearchLeak required one click on a crafted search link. EchoLeak carries a higher CVSS score (9.3), reflecting its lower interaction requirement.
What data could SearchLeak expose?
Reporting on the flaw lists emails, calendar and meeting details, Teams messages, SharePoint documents, OneDrive files, and any MFA codes or password-reset links present in a victim’s indexed content, limited to whatever the clicking user already had permission to access.
Does this affect all Microsoft 365 Copilot users?
The disclosed flaw specifically affected Microsoft 365 Copilot Enterprise Search. Because Microsoft patched the issue at the service level, customers do not need to take any tier-specific action to be protected going forward.
Should enterprises stop using Copilot because of this?
Security researchers covering the disclosure have not recommended abandoning Copilot. The consensus recommendation is to treat AI assistants with broad data access as a distinct part of the security review process, auditing what they can index and monitoring their behavior, rather than avoiding the category of tool entirely.
