SearchLeak: how one click could have leaked your Microsoft 365 Copilot data

What actually happened, in plain English

SearchLeak chained three weaknesses together, each one setting up the next.

1. The AI read a web link as an instruction. Copilot Enterprise Search takes your question from part of its web address. Normally that is just your search words — but the researchers found Copilot would treat text placed there as commands ("search this mailbox, take an email subject, and tuck it inside an image") rather than as a simple query. The victim types nothing; they click a crafted link and Copilot quietly does the work. Varonis calls this parameter-to-prompt injection.

2. A timing gap let the data slip out. Microsoft wraps Copilot's answers in code formatting so the browser treats any markup as plain text. But that wrapping happens after Copilot finishes writing, while the browser is already drawing the response as it streams in. An injected image tag fired its request in that window, before the safety net dropped.

3. Microsoft's own service carried the data away. The page only allows images from Microsoft-approved domains — and Bing is on that list. Bing's "search by image" feature fetches an image address from its own servers, so the researchers pointed it at their server with the stolen text hidden in the address. Bing fetched it, the data left, and the browser's protections never applied, because the request came from Microsoft's infrastructure rather than the user's browser.

In short: you click, Copilot reads your data, the answer hides a snippet — say, an email subject — inside an image link, and Microsoft's own image service delivers it to the attacker, who simply reads it off their server logs.

The real takeaway for your business

You do not need to do anything about SearchLeak itself — it is fixed. But it is a useful prompt to ask a bigger question: as we switch on Copilot and other AI tools, who has checked what they can actually see, and who is watching how they behave?

Three things make the difference, and none of them are about this one bug.

Govern what Copilot can reach. Copilot surfaces whatever a person already has permission to open — including the over-shared folder, the "everyone" SharePoint site, and the old files nobody ever cleaned up. Tightening permissions to least privilege does not just tidy your data; it shrinks the blast radius of any future leak. For most businesses this is the single highest-value step to take before — or right after — turning Copilot on, and it is exactly what we cover when we help you use AI safely.

Watch for the unusual. The defence against a managed-service flaw you cannot patch is detection — spotting odd Copilot activity or unexpected outbound requests and stepping in quickly. That is what a security operations centre is for, and ours runs in-house, around the clock.

Treat an AI rollout as a security project, not just an IT switch. A Microsoft Copilot deployment touches your most sensitive data, so it deserves the same care as any other security change: review access first, set guardrails, brief your people, and keep an eye on it once it is live.

And the timeless one: be wary of links, even ones that appear to go to a name you know. SearchLeak worked precisely because the link looked completely legitimate.