AIDEFEND in Action AIA-0032 Validated Research Published: Jun 22, 2026

SearchLeak: How a Microsoft 365 Copilot Search Link Became a One-Click Data Exfiltration Path

SearchLeak shows how a trusted Microsoft 365 Copilot Enterprise Search URL (the enterprise search surface for Microsoft 365 data) can turn dangerous when the q parameter is treated as instructions instead of a query. Varonis chained that parameter-to-prompt flaw with a streaming HTML rendering race and a Bing image SSRF path, so one click could move user-accessible Microsoft 365 data into an attacker-controlled URL. Defenders need pre-model query validation, render-before-network sanitization, and data-flow policy on outbound fetches.

Prompt InjectionData ExfiltrationSink EnforcementAI CopilotsEnterprise AI
6 applicable AIDEFEND defenses
Source: SearchLeak: How We Turned M365 Copilot Into a One-Click Data Exfiltration Weapon 
Authors: Dolev Taler, Varonis Threat Labs
Original article: Jun 15, 2026

Threat Analysis

  • Step 1: hide instructions in the search URL. The attacker puts prompt-like text in the Copilot Search q parameter. The link still points to Microsoft, but the query asks Copilot to find internal data and place a value inside an image URL.
  • Step 2: run the query with the victim's access. After the victim clicks, Copilot treats q as instructions and searches Microsoft 365 content the user can reach, including mailbox, calendar, SharePoint, OneDrive, and indexed organizational files.
  • Step 3: exploit streaming output. Copilot streams an HTML img tag before final sanitization turns the answer into inert text. The browser sees the tag and sends the image request before the renderer catches up.
  • Step 4: relay through Bing. CSP blocks direct attacker domains, but Bing image-search endpoints are allowed. Bing then performs the server-side fetch to the attacker URL, with the selected Microsoft 365 data carried in the path. Microsoft remediated the issue as CVE-2026-42824.

Applicable AIDEFEND Defenses (6)

AID-H-006.002
Text, Markup & Structured Output Sanitization and Release Gate
High
Use G004 full_response mode to hold the complete answer before any byte enters the browser, then apply G005 to remove remote subresources and disable automatic previews. A separately verified detector/status adapter and a sink-specific sanitizer are required; checks performed after streamed markup has already reached the DOM cannot recall an image request. Ordinary links and plain malicious text remain, so link policy and explicit user actions are separate controls.
AID-H-002.002
Inference-Time Prompt & Input Validation
High
Apply G009 to URL-prefilled q input: opening, previewing or prefetching the link must perform zero inference and tool calls. Store an external draft for the authenticated tenant/user, display its exact text, and require a bound explicit submission. Confirmation grants neither Microsoft 365 reads nor tool authority. The sample transforms still require authenticated routes, a server-side draft store and atomic single-use run creation; product-side control is necessary.
AID-D-001.001
Per-Prompt Content, Intent & Obfuscation Analysis
Medium
Screen the exact decoded q text before inference for a shift from searching to retrieving internal values and embedding them in outbound URLs. G001 supplies calibrated detection evidence; a separate admission gate decides whether inference may proceed. It does not itself disable URL-triggered execution or authorize Microsoft 365 reads. Before admission, independently require every necessary classifier category and a finite score in the valid range. The current G001 sample can return PASS/NO_FINDING for empty results, missing categories or NaN scores; treat these as errors and refuse admission. This additional result-contract validation is not implemented by the published sample. False negatives still require separate tool and output controls.
AID-D-003.002
Sensitive Information & Data Leakage Detection
Medium
Scan the exact complete response and independently extracted nested URL fields for verified credential/PII formats and configured tenant-specific literals or bounded patterns. The common-format sample does not recognize arbitrary MFA codes, email subjects or meeting details. URL decoding and field coverage require separate adapters; encoded or novel values can evade detection. Findings feed the independent release or sink gate and do not themselves block a request.
AID-H-018.005
Value-Level Capability Metadata & Data Flow Sink Enforcement
Medium
This is the most direct control for the actual exfiltration path. Copilot may be allowed to retrieve user-accessible Microsoft 365 data, but those values should not be allowed to flow into image URLs, preview services, or any outbound network sink unless policy explicitly permits that value and destination together. This requires a controlled runtime with authenticated source/content bindings for every derived value, complete sink coverage and fail-closed unknown labels. One ingress label does not track arbitrary model rewriting. Native processes, browser requests and allowed destinations need separately verified coverage; stock SaaS deployment is not established.
AID-H-016.001
System Prompt Structure & Instruction/Data Separation
Medium
Even when a search query is valid, the model needs an explicit instruction hierarchy that keeps URL parameters in a data-only role. The search string can describe what to find, but it should not be able to redefine response behavior, suppress warnings, or turn the answer into an outbound request generator. This requires control of the real prompt serializer. Structural separation reduces spoofing; it does not guarantee model obedience or authorize an action. Tool and output authorization must remain independent; stock SaaS capability is not assumed.

What Defenders Should Do Now

  • Verify Microsoft's remediation for CVE-2026-42824 and keep tracking service advisories, release notes, and any tenant-specific security guidance for Microsoft 365 Copilot.
  • Limit Copilot's data access scope so it does not read unnecessary high-sensitivity data. Review SharePoint, OneDrive, mailbox, calendar, and external-sharing permissions; remove broad access; and label or protect high-sensitivity data with DLP where possible.
  • Add detections in the tools the enterprise actually controls, such as Defender, Purview, proxy, CASB, or SIEM. Useful signals include suspicious Copilot Search links, long or encoded q parameters, Bing image-search requests, and internal-looking values inside outbound URL paths.
  • Treat Copilot Search links as a phishing and data-exfiltration surface. Give users a simple reporting path for unexpected Copilot links, especially links that arrive through email or chat and contain unusually long query strings.
  • Use this case in AI product security reviews. Ask Microsoft or any copilot provider how it validates search parameters, sanitizes streaming output before network requests, inspects final URL destinations, prevents SSRF relay paths, and blocks sensitive values from flowing into external URLs.

Conclusion

SearchLeak matters because it turns several small product behaviors into one working attack chain: a search parameter becomes an instruction, streamed model output becomes browser behavior, and an allowlisted Microsoft service becomes the final network relay. The lesson is to enforce boundaries where data changes role: before search text becomes model input, before model output becomes browser activity, and before Microsoft 365 data can enter an external URL.

Many of the strongest controls must live inside the product. Enterprise customers still have work to do: verify remediation, limit Copilot's data access scope, monitor suspicious outbound connection behavior, and use this case as a concrete requirement in AI product security reviews.

Last updated: