One Click, Total Compromise: The Microsoft Copilot Vulnerability That Changed Everything

Imagine visiting a seemingly innocuous link on a reputable Microsoft website, only to have your most private information, emails, files, calendar entries, and even multi-factor authentication (MFA) codes, silently fall into the hands of a hacker. You never entered a password. You never gave your approval to a prompt. It only required one click.

That was the truth of a critical vulnerability chain in Microsoft 365 Copilot Enterprise Search that has since been patched. With only one click, the enterprise AI assistant became a "silent data exfiltration weapon," a vulnerability known as CVE-2026-42824 and dubbed SearchLeak by the researchers who found it.

The Three‑Stage Attack Chain

Varonis Threat Labs discovered the exploit, which linked three different flaws: two older, traditional online vulnerabilities and a new AI-specific problem.

• Parameter to Prompt Injection (AI-Specific)

               The assault started with a specially constructed URL that included a secret "q parameter" in the Copilot Enterprise Search link. Conventional anti-phishing and URL filters were unable to identify the link because it went to a valid microsoft.com domain.

               When the victim clicked, Copilot understood the parameter as commands to follow rather than just reading it as a search phrase. This is what Varonis refers to as a Parameter-to-Prompt (P2P) injection: by instructing Copilot to search the victim's mailbox and incorporate the findings                inside an image URL, the attacker has essentially transformed Copilot into their own agent.

• Race Condition for HTML Sanitizer

               Copilot's replies are wrapped in <code> blocks by Microsoft to prevent harmful output, which causes the browser to interpret them as text. However, there was a crucial timing error: the wrapping occurs after Copilot has finished generating. As the stream comes in, the browser                         renders it. This meant that before the sanitizer could neutralize an injected <img> tag, it fired its request. The data was gone by the time the output was secured.

• Bing as an Unwitting Exfiltration Proxy

               The final obstacle was the Content Security Policy (CSP) on m365.cloud.microsoft, which blocks images from arbitrary domains. However, it allows *.bing.com. Attackers exploited Bing's “Search by Image” endpoint, which fetches an image URL server‑side. By pointing that fetch at                 an attacker‑controlled server with stolen data encoded in the path, Bing became the exfiltration proxy. The CSP never applied because the request came from Bing's own infrastructure.

The Payload: What an Attacker Could Steal

Copilot Enterprise operates with all of the signed-in user's permissions. Without ever logging in, the attacker inherited that reach. The targets that posed the greatest risk were:

• One-time passwords, MFA codes, and password-reset links that are waiting in the mailbox are frequently only good for a short while.

• meeting notes, calendar invites, and emails.

• files from OneDrive and SharePoint that have been indexed, including financial data, purchase plans, and pay information.

• To put it succinctly, the attacker obtained all of the victim's resources.

What This Means for You

Microsoft used its own severity criteria to evaluate this vulnerability as critical (10/10) and patched it on its backend. Customers didn't had to do anything because Copilot Enterprise is a managed service. However, SearchLeak is a potent example of how AI uses well-known vulnerabilities to develop completely new attack routes.

The key takeaways for organizations:

• AI‑specific threats are real: Parameter‑to‑prompt injection is a new class of vulnerability that traditional security tools are not designed to catch.

• Trusted domains are no longer safe: The malicious link lived on a real microsoft.com address—even the most vigilant user could have fallen for it.

• Defense in depth is essential: No single control would have stopped this chain. It required layered detection, AI‑specific awareness, and rapid vendor response.

How Bayon Technologies Group Can Help You Stay Safe

At Bayon Technologies Group, we assist businesses in navigating the emerging landscape of dangers driven by AI. The SearchLeak vulnerability serves as a clear reminder that AI products are possible attack vectors in addition to being productivity boosters. 

We assist you:

• To find weaknesses in your enterprise AI integrations, do risk assessments tailored to AI.

• Put in place sophisticated monitoring for encoded URL parameters and questionable Copilot search patterns.

• By teaching users to identify and report fraudulent links, even on reputable domains, you can bolster your human firewall.

• Create incident response strategies that are specific to situations involving AI-enabled data exfiltration.

AI is changing the security landscape more quickly than most businesses can keep up. To make sure your defenses are keeping up, get in touch with Bayon Technologies Group right now.