Copilot flaw let attackers steal data

Security firm Varonis disclosed an exploit chain it calls SearchLeak that let an attacker pull data out of a victim’s Microsoft 365 Copilot account with a single crafted link. Microsoft patched the holes on June 16, the day the research went public.

The attack starts with an email containing a Microsoft search URL whose query parameter hides an instruction, a trick Varonis calls a parameter-to-prompt injection. Copilot reads the instruction and complies, searching the user’s own emails. To smuggle the stolen text out, the exploit renders raw HTML before a guardrail can wrap the output as plain text, then bounces an image request through Microsoft’s own Bing search to slip past the rule that blocks Copilot from contacting untrusted sites. In the proof of concept, that was enough to lift the contents of an email, including a two-factor login code.

Why this matters

The root cause is not a bug Microsoft can simply close. As Varonis and Ars Technica explain, large language models cannot reliably tell the difference between instructions from you and instructions hidden inside the content they read. Microsoft fixed this specific chain; the underlying weakness stays, and attackers will build the next one.

If you let an AI assistant read your mailbox, files, or chats, treat it as something that can be talked into acting against you. Give it the least access it needs, the way you would scope any tool that touches your data. Be wary of links that ask an assistant to “summarize” or “search,” and keep a human checking the work on anything that moves data or money. Convenience and exposure are now the same setting.