Microsoft patches Copilot flaw allowing 1-click data theft

A recently patched vulnerability in Microsoft 365 Copilot Enterprise allowed attackers to steal sensitive organizational data, including authentication codes and corporate files, through a single click on a legitimate Microsoft link. The flaw, known as "SearchLeak," was patched by Microsoft on June 4, 2026, and required no manual updates from customers.

The security issue, tracked as CVE-2026-42824, was discovered by researchers at Varonis Threat Labs. They chained three distinct weaknesses: a parameter-to-prompt injection, an HTML rendering race condition, and a content security policy bypass involving Bing. The attack began when a victim clicked a crafted Microsoft URL. The link contained malicious instructions within the standard search query parameter, which the Copilot AI interpreted as commands to search the user's mailbox or files. It would then embed the results, such as email titles or multi-factor authentication codes, into an image URL.

Critical to the exploit was how the system's defenses were circumvented. Microsoft's guardrails attempted to sanitize output by wrapping it in code blocks, but this occurred after Copilot finished generating its response. During the...