{"schema_version":"0.10.0","id":"LR-2026-0580","record_version":1,"title":"SearchLeak flaw in Microsoft 365 Copilot exposed data","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":50.3,"score_breakdown":{"source_authority":12.1,"independent_corroboration":7.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":3.0,"completeness":6.72,"unhedged_language":5.0},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true,"record_integrity":true,"eligible":true,"about_this_case":true},"gate_version":"gate-2026-10-18.7","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-11-01","extraction_run_id":null,"evidence_level":{"level":"preliminary","reason":"1 report: Tech Insider · subject to change","original_document":null,"reports_total":1,"reports_independent":1,"reports_derivative":0,"developing":false,"disputed":false,"rules_version":"evidence-2026-10-29.1","computed_at":"2026-11-01","history":[{"date":"2026-11-01","from_level":null,"to_level":"preliminary","reason":"1 report: Tech Insider · subject to change"}]},"sources_hash":"95816753be3e6afc46d802a96f54a4d94544d3d9ad36f033788d1c87fec6063f"},"system":{"model_name":null,"model_version":null,"developer":"Microsoft","harness":null,"tools_granted":[],"permissions_scope":"the clicking user's own permissions","autonomy_level":"unknown","guardrails_present":[],"deployment_context":"unknown","tier":null,"lifecycle_stage":"production","integration_type":null,"intended_use":null,"safeguard_state":null,"production_intended":null},"event":{"date_occurred":null,"date_disclosed":"2026-06-15","incident_class":"security_compromise","failure_class":null,"agent_involved":true,"secondary_failure_classes":[],"trigger":"prompt_injection","duration":null,"detection_method":"unknown","summary":"Microsoft 365 Copilot Enterprise Search, an AI search layer that pulls answers from a user’s email, calendar, Teams, SharePoint and OneDrive content, was found to be exposed to a chained flaw called SearchLeak, tracked as CVE-2026-42824. A victim who clicked one link pointing to a legitimate Microsoft domain could have Copilot act on instructions hidden in that link. Copilot would search content the victim could already see and send it out through a Bing-mediated request that looked like ordinary trusted Microsoft traffic. Varonis Threat Labs disclosed the chain on June 15, 2026. Microsoft patched the issue on its servers, requiring no customer installation, and no vendor reported exploitation in a real attack. The sources do not state how long the flaw existed in production.","tags":[],"date_detected":null,"near_miss":null,"root_cause":null,"root_cause_detail":null,"failure_class_detail":null,"responsible_party":"provider","adversarial_actor":"external_attacker","input_provenance":"a single Copilot Enterprise Search link pointing to a legitimate Microsoft domain","time_to_contain":null,"operations_paused":null,"remediation":"Patched server-side by Microsoft","precursor_events":null,"primary_risk":"RK01","secondary_risks":["RK04"],"control_chain":[{"layer":"L3","party":"deployer","party_name":null,"control_id":"H2","outcome":"got_around","reason":null,"quote":"Because Bing’s domains sit on Microsoft’s own allowlist, the outbound data transfer looked, to any enterprise data-loss-prevention tool watching the network, like ordinary traffic to a trusted Microsoft domain.","source_index":0,"reviewed":false}],"remediations":[{"by":null,"kind":"fix","date_reported":null,"controls_added":["J1"],"quote":"Microsoft has since patched the issue on its servers, and no vendor has reported it being used in a real attack.","source_index":0,"reviewed":false}]},"impact":{"direct_loss_usd":null,"remediation_hours":null,"records_exposed":null,"third_parties_affected_count":null,"severity":"moderate","severity_because":"Bounded scope stated: the attacker never gained access to more than the victim already had, since the flaw was a disclosure bug and not privilege escalation.","harm_class":["privacy"],"affected_description":null,"protected_class_involved":null,"data_categories_exposed":["email","calendar","chat messages","documents","authentication codes"],"loss_range_usd":null,"reversibility":null,"downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://tech-insider.org/searchleak-m365-copilot-vulnerability-2026/","publisher":"tech-insider.org","date":"2026-06-28","type":"press","title":"SearchLeak: Microsoft 365 Copilot Flaw Exposed [2026] - tech-insider.org","archived_url":null,"attachment":"first_report","independence":"independent"}],"per_field_confidence":{"system.developer":"C","system.permissions_scope":"C","system.lifecycle_stage":"C","event.date_disclosed":"C","event.incident_class":"C","event.agent_involved":"C","event.trigger":"C","event.responsible_party":"C","event.adversarial_actor":"C","event.input_provenance":"C","event.remediation":"C","impact.severity_because":"C","impact.harm_class":"C","impact.data_categories_exposed":"C","impact.severity":"D","event.primary_risk":"D","event.secondary_risks":"D","event.control_chain":"C","event.remediations":"C","event.summary":"C","system.autonomy_level":"D","system.deployment_context":"D","event.detection_method":"D","context.country":"D","context.denominator_available":"D"},"field_citations":{"system.developer":[{"source_index":0,"quote":"Microsoft has since patched the issue on its servers, and no vendor has reported it being used in a real attack."}],"system.permissions_scope":[{"source_index":0,"quote":"Because Copilot Enterprise Search operates with the clicking user’s own permissions, SearchLeak was a disclosure bug, not a privilege-escalation bug."}],"system.lifecycle_stage":[{"source_index":0,"quote":"Microsoft has not published a detailed account of exactly how long SearchLeak existed in production before Varonis found it, a gap independent researchers have flagged in coverage of the disclosure."}],"event.date_disclosed":[{"source_index":0,"quote":"On June 15, 2026, Varonis Threat Labs published the flip side of that pitch."}],"event.incident_class":[{"source_index":0,"quote":"The bug, dubbed SearchLeak and tracked as CVE-2026-42824, chained three separate flaws in Microsoft 365 Copilot Enterprise Search into one exfiltration path: prompt injection, a rendering race condition, and a server-side request forgery riding on Bing’s own infrastructure."}],"event.agent_involved":[{"source_index":0,"quote":"A victim only had to click a single Copilot Enterprise Search link, one pointing to a legitimate Microsoft domain, for Copilot to start acting on attacker-supplied instructions hidden inside the link itself."}],"event.trigger":[{"source_index":0,"quote":"Copilot’s underlying model doesn’t reliably separate “what the user typed” from “what showed up in the URL,” so it followed the embedded instruction as though the user had typed it."}],"event.responsible_party":[{"source_index":0,"quote":"Microsoft has since patched the issue on its servers, and no vendor has reported it being used in a real attack."}],"event.adversarial_actor":[{"source_index":0,"quote":"Instead of a normal search term, an attacker could embed text formatted to resemble an instruction."}],"event.input_provenance":[{"source_index":0,"quote":"A victim only had to click a single Copilot Enterprise Search link, one pointing to a legitimate Microsoft domain, for Copilot to start acting on attacker-supplied instructions hidden inside the link itself."}],"event.remediation":[{"source_index":0,"quote":"Microsoft has since patched the issue on its servers, and no vendor has reported it being used in a real attack."}],"impact.severity_because":[{"source_index":0,"quote":"Because Copilot Enterprise Search operates with the clicking user’s own permissions, SearchLeak was a disclosure bug, not a privilege-escalation bug."}],"impact.harm_class":[{"source_index":0,"quote":"Varonis’s write-up and subsequent coverage list emails, meeting and calendar details, Teams messages, SharePoint documents, and OneDrive files as exposed content, along with any multi-factor authentication codes or password-reset links sitting in a user’s inbox at the time."}],"impact.data_categories_exposed":[{"source_index":0,"quote":"Varonis’s write-up and subsequent coverage list emails, meeting and calendar details, Teams messages, SharePoint documents, and OneDrive files as exposed content, along with any multi-factor authentication codes or password-reset links sitting in a user’s inbox at the time."}],"impact.severity":[{"source_index":0,"quote":"Because Copilot Enterprise Search operates with the clicking user’s own permissions, SearchLeak was a disclosure bug, not a privilege-escalation bug."}],"event.control_chain":[{"source_index":0,"quote":"Because Bing’s domains sit on Microsoft’s own allowlist, the outbound data transfer looked, to any enterprise data-loss-prevention tool watching the network, like ordinary traffic to a trusted Microsoft domain."}],"event.remediations":[{"source_index":0,"quote":"Microsoft has since patched the issue on its servers, and no vendor has reported it being used in a real attack."}],"event.summary":[{"source_index":0,"quote":"Researchers had found a way to turn that same search index into a data pipe for attackers, triggered by nothing more than a single click on what looked like an ordinary Microsoft link."},{"source_index":0,"quote":"A victim only had to click a single Copilot Enterprise Search link, one pointing to a legitimate Microsoft domain, for Copilot to start acting on attacker-supplied instructions hidden inside the link itself."},{"source_index":0,"quote":"From there, Copilot would search whatever content the victim already had permission to see, then quietly ship it back to the attacker using Microsoft’s own infrastructure as the delivery truck."},{"source_index":0,"quote":"On June 15, 2026, Varonis Threat Labs published the flip side of that pitch."},{"source_index":0,"quote":"Microsoft has since patched the issue on its servers, and no vendor has reported it being used in a real attack."},{"source_index":0,"quote":"Microsoft has not published a detailed account of exactly how long SearchLeak existed in production before Varonis found it, a gap independent researchers have flagged in coverage of the disclosure."}]},"notes_on_gaps":"Single source (Source 0, a press article); no primary Microsoft or Varonis report was provided. Not stated: model name and version, harness, tools granted, autonomy level, date of occurrence, date of detection, the exact duration the flaw existed, containment time, records exposed, affected party count, direct loss, and root cause in named terms. failure_class was omitted because the source does not describe a failure class label for the agent. Judgement: agent_involved set true because Copilot acted on instructions; lifecycle_stage production taken from the source's reference to the flaw existing in production; severity moderate because the scope is bounded to what the victim could access, while the number of affected parties is not stated. CVSS scores are disputed across sources and were not recorded. The remediation control J1 was chosen as the closest fit for a server-side patch; the source names no control. Controls C1 and H2 are the ones the source ties to this incident; no control was marked held. [case created by the backfill: read by claude-haiku-5-5, backfill-2026-11-01.2, 2026-11-01; not yet reviewed] [2026-11-01: evidence level set: Preliminary (1 report: Tech Insider · subject to change)]"},"context":{"industry":null,"org_size_band":null,"country":"unknown","denominator_available":false,"denominator":null,"related_incident_ids":[],"systemic_exposure":null,"shared_model_id":null,"upstream_incident_id":null,"incident_evidence":null,"regulatory":null,"coverage":null},"narrative":{"steps":[{"step":"doing","text":"Copilot Enterprise Search pulled answers from users' email, calendar, Teams, SharePoint and OneDrive content.","quote":"SearchLeak is the name Varonis Threat Labs gave to a vulnerability chain it discovered in Microsoft 365 Copilot Enterprise Search, the AI-powered search layer that lets Copilot pull answers from a user’s email, calendar, Teams messages, SharePoint sites, and OneDrive files.","source_index":0,"grade":"C"},{"step":"went_wrong","text":"A single click on a crafted link led Copilot to act on instructions hidden in the link.","quote":"A victim only had to click a single Copilot Enterprise Search link, one pointing to a legitimate Microsoft domain, for Copilot to start acting on attacker-supplied instructions hidden inside the link itself.","source_index":0,"grade":"C"},{"step":"reached","text":"Copilot searched what the victim could already see and sent it out via Microsoft infrastructure.","quote":"From there, Copilot would search whatever content the victim already had permission to see, then quietly ship it back to the attacker using Microsoft’s own infrastructure as the delivery truck.","source_index":0,"grade":"C"},{"step":"done","text":"Microsoft patched the issue server-side; no vendor reported real-world exploitation.","quote":"Microsoft has since patched the issue on its servers, and no vendor has reported it being used in a real attack.","source_index":0,"grade":"C"}],"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://tech-insider.org/searchleak-m365-copilot-vulnerability-2026/"]},"analysis":{"sections":{"timeline":[{"text":"NVD first published CVE-2026-42824.","quote":"The National Vulnerability Database tracks the underlying flaw as CVE-2026-42824, first published on June 4, 2026, and updated on June 19.","source_index":0,"when":"2026-06-04"},{"text":"NVD record for CVE-2026-42824 was updated.","quote":"The National Vulnerability Database tracks the underlying flaw as CVE-2026-42824, first published on June 4, 2026, and updated on June 19.","source_index":0,"when":"2026-06-19"}]},"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://tech-insider.org/searchleak-m365-copilot-vulnerability-2026/"]}}