Microsoft 365 Copilot Security: What SearchLeak Revealed

Security researchers at Varonis just demonstrated how to steal emails, OneDrive files, and SharePoint documents from any Microsoft 365 Copilot Enterprise user with a single link click. The victim sees nothing unusual. Microsoft patched the flaw earlier this month under CVE-2026-42824 with a critical severity rating. But the broader question this disclosure opens is not about this specific CVE.

What SearchLeak Actually Did

Varonis researchers called it SearchLeak. The attack chained three separate weaknesses in Microsoft 365 Copilot Enterprise Search into a single working exploit.

Microsoft 365 Copilot Enterprise Search is the version of Copilot that scans your company data. Emails, meetings, SharePoint files, OneDrive documents. All of it. The attack worked by exploiting how Copilot accepts a URL query parameter to receive search instructions.

An attacker crafts a URL that tells Copilot to search the victim's mailbox and format the results into an outbound image request. The victim clicks the link. Copilot executes the embedded instructions. The image request goes out through Bing, carrying stolen data encoded in the URL string. The attacker reads it from their server logs.

"The victim doesn't type anything. They click a link, and Copilot takes care of the rest," the Varonis team wrote in their disclosure.

From the victim's perspective, Copilot appears to think for a moment. No error. No warning. The data is already exfiltrated.

Microsoft assigned CVE-2026-42824 a critical severity rating and addressed it cloud-side at the beginning of June 2026. Because the fix is server-side, there is no patch to deploy. If you're using M365 Copilot Enterprise Search today, the specific vulnerability is mitigated.

Why This Matters for Growing Businesses

The patch is live. The structural issue it exposed is not going away.

Microsoft 365 Copilot Enterprise Search has broad access to business data by design. That is the feature. It can see emails from three years ago, calendar entries, documents in SharePoint sites your employees have not opened since 2022, OneDrive folders shared across departments. Copilot can search all of it.

When an AI tool has that level of access, any vulnerability in that tool becomes a data breach vector. A single crafted link becomes a path to everything the AI can read.

For a 40-person professional services firm in Parsippany, that might be client contracts in SharePoint, billing records in OneDrive, and sensitive conversations from email threads that predate the Copilot rollout entirely. SearchLeak could have touched all of it.

That is a different risk profile than a vulnerability in, say, a VPN configuration or a web application. The blast radius of an AI tool vulnerability scales with whatever the AI can access.

The Pattern Is Bigger Than One CVE

SearchLeak is not an isolated finding. It is part of a trend.

In April, researchers documented how M365 Copilot could be used to surface data from overshared SharePoint sites, exposing documents users never intended to make broadly accessible. In May, separate research showed how AI browser agents running in employee sessions could be manipulated through injected content. Now SearchLeak.

Varonis put the underlying problem clearly: "AI systems have created new pathways to exploit older bug classes in contexts where they previously would not have been nearly as impactful."

The bugs themselves, SSRF, HTML injection race conditions, parameter injection, are not new. They have existed in various forms for years. What changed is the context. When those bugs exist in a system that also has access to your entire mailbox and document library, the impact is orders of magnitude higher than the same bug in a less privileged application.

The AI feature creates the opportunity. The bug creates the opening. The combination is what security researchers are now finding repeatedly.

Three Things Worth Doing Now

Microsoft patched CVE-2026-42824, and no user action is required for the specific SearchLeak flaw. But if this story prompts a review of how Copilot is deployed in your organization, that is a reasonable response.

Audit what Copilot can actually access. M365 Copilot Enterprise Search only surfaces data that users have permission to see. If employees have overshared SharePoint sites, or sensitive documents sit in broadly accessible locations, Copilot exposes that oversharing at scale. The Copilot rollout is a good forcing function for a permissions review. More detail on this is in an earlier post on M365 Copilot and SharePoint oversharing.

Scope AI tool permissions to what is actually needed. Copilot does not need access to SharePoint libraries that have not been updated in two years. Limiting what the AI can see limits the blast radius of any future vulnerability. Least privilege applies to AI tools the same way it applies to service accounts.

Keep someone watching security advisories. Microsoft patches critical vulnerabilities in M365 cloud services. The patching is often automatic, but understanding what was patched, and what data may have been at risk during the window between discovery and remediation, requires someone who is paying attention. For a 50-person team without a dedicated security staff, that is usually a managed IT partner watching the patch bulletins.

The specific CVE is closed. The next one in this category is not yet known. That has always been true of software security. What has changed is that the AI feature layer sits on top of more sensitive business data than almost any other enterprise software deployed in the past decade.

Frequently Asked Questions

Is Microsoft 365 Copilot safe to use after this patch? Yes. CVE-2026-42824 was patched by Microsoft on the server side in early June 2026. No user action is required. Standard Copilot features remain available.

Does SearchLeak affect all M365 Copilot plans or only Enterprise? The Varonis research specifically targeted Microsoft 365 Copilot Enterprise Search, which scans company data across email, OneDrive, and SharePoint. Standard M365 Copilot features outside of Enterprise Search were not the focus of this disclosure.

How would a business know if it was targeted before the patch? Most would not. The attack leaves minimal user-facing traces. Monitoring outbound network requests from M365 infrastructure at the SIEM level could potentially flag anomalous Bing image requests, but that kind of detection is uncommon without a dedicated security toolset in place.

What should businesses do about M365 Copilot permissions? Review SharePoint and OneDrive sharing configurations. Copilot returns data that users already have permission to access, so tightening overshared permissions reduces what Copilot can expose in any future vulnerability scenario. Microsoft publishes a data security review guide specifically for Copilot deployments.

Does this mean businesses should avoid M365 Copilot? No. The risk is manageable with proper configuration and monitoring. The point is that AI tools with broad data access require the same security discipline as any other business-critical software. Configuration, permissions scoping, and patch awareness all apply.