AI Risk Wire

Cases › security breach › LR-2026-0580

SearchLeak flaw in Microsoft 365 Copilot exposed data

Preliminary Why: 1 report: Tech Insider · subject to change · 1 independent report

Status: fix reported

Severity moderate
Reported 15 Jun 2026
Developer and model Microsoft

No source states: loss or records, agent tool, could do, deployer, industry.

Severity moderate: Bounded scope stated: the attacker never gained access to more than the victim already had, since the flaw was a disclosure bug and not privilege escalation.

Microsoft 365 Copilot Enterprise Search, an AI search layer that pulls answers from a user’s email, calendar, Teams, SharePoint and OneDrive content, was found to be exposed to a chained flaw called SearchLeak, tracked as CVE-2026-42824. A victim who clicked one link pointing to a legitimate Microsoft domain could have Copilot act on instructions hidden in that link. Copilot would search content the victim could already see and send it out through a Bing-mediated request that looked like ordinary trusted Microsoft traffic. Varonis Threat Labs disclosed the chain on June 15, 2026. Microsoft patched the issue on its servers, requiring no customer installation, and no vendor reported exploitation in a real attack. The sources do not state how long the flaw existed in production.

What happened

1 · What it was doingCopilot Enterprise Search pulled answers from users' email, calendar, Teams, SharePoint and OneDrive content.
2 · What went wrongA single click on a crafted link led Copilot to act on instructions hidden in the link.
3 · What it reached or didCopilot searched what the victim could already see and sent it out via Microsoft infrastructure.

What was done

Microsoft patched the issue server-side; no vendor reported real-world exploitation.
Fix reported

“Microsoft has since patched the issue on its servers, and no vendor has reported it being used in a real attack.”

Known flaws patched

Same developer, same risk, after the fix: LR-2026-0305

Risks

Hidden instructions hijack the agent
Primary50 incidents
Rising: 6 vs 2.8 a week
Data leaked or sent out
Also32 incidents

Read from the sources; not yet reviewed by a person.

Controls

Application

Not effective (bypassed) Sensitive-data checks on outbound data

Control failure chain

L1 · Model Not stated in sourcesMicrosoft
L2 · Harness Not stated in sourcesHarness not named
L3 · Application Not effective (bypassed)Deployer not named
L4 · Infrastructure / target Not stated in sourcesOrganisation hit

L1 · ModelMicrosoftModel provider

No source mentions a control at this layer.

Model version not linked to a model card.

L2 · HarnessHarness not namedAgent framework vendor

No source mentions a control at this layer.

Other controls for this risk at this layer, not mentioned in the sources: Outside content treated as data, not instructions, Prompt-injection detection, Confirmation after untrusted input, Validation of tool inputs and outputs, Tool allow-list.

L3 · ApplicationDeployer not namedDeployer

Not effective (bypassed)Sensitive-data checks on outbound data“Because Bing’s domains sit on Microsoft’s own allowlist, the outbound data transfer looked, to any enterprise data-loss-prevention tool watching the network, like ordinary traffic to a trusted Microsoft domain.”tech-insider.org

Other controls for this risk at this layer, not mentioned in the sources: Human approval for high-impact actions, Least-privilege access for the agent, Segmentation of agent components, Alerts on unusual tool use.

L4 · Infrastructure / targetOrganisation hit

No source mentions a control at this layer.

EffectiveNot effectiveNot effective (bypassed)Did not existNot stated in sourcesNot yet checkedAttacker's ownOrder: model · harness · application · target

Controls for this risk: result in this incident

ControlPart of the systemResult
Tool allow-listL2 HarnessNot stated in sources
Confirmation after untrusted inputL2 HarnessNot stated in sources
Outside content treated as data, not instructionsL2 HarnessNot stated in sources
Prompt-injection detectionL2 HarnessNot stated in sources
Validation of tool inputs and outputsL2 HarnessNot stated in sources
Sensitive-data checks on outbound dataL3 ApplicationNot effective (bypassed)
Least-privilege access for the agentL3 ApplicationNot stated in sources
Human approval for high-impact actionsL3 ApplicationNot stated in sources
Segmentation of agent componentsL3 ApplicationNot stated in sources
Alerts on unusual tool useL3 ApplicationNot stated in sources

Similar incidents

EchoLeak zero-click prompt injection exploit in Microsoft 365 Copilot2025-11-23
Microsoft 365 Copilot bug raises data security concerns2026-03-02
AutoJack flaw in Microsoft AutoGen Studio enabled code execution, fixed during development2026-06-22
Reprompt: a single malicious Copilot link could expose user data2026-01-24

All cases of this kind ›

Evidence

No source states: how it was caught, when it happened, when it was found, how many records were exposed, the direct loss, a count of the other parties affected, any court case, the cause.

Show the full account: 2 items from the primary sources

What happened, in order

  1. 2026-06-04 NVD first published CVE-2026-42824.
  2. 2026-06-19 NVD record for CVE-2026-42824 was updated.
Show every field, with its source and grade

The AI system

Developer
Microsoft
C one secondary source states it
What it was allowed to do
the clicking user's own permissions
C one secondary source states it
Stage of the model
in live use
C one secondary source states it

What happened

Earliest source we hold
2026-06-15
C one secondary source states it
What set it off
hidden instructions in its input
C one secondary source states it
Who was responsible
the model provider
C one secondary source states it
Who caused it
an outside attacker
C one secondary source states it
Where its input came from
a single Copilot Enterprise Search link pointing to a legitimate Microsoft domain
C one secondary source states it
What was done
Patched server-side by Microsoft
C one secondary source states it
What went wrong
security breach
C one secondary source states it
AI agent
an AI agent acted
C one secondary source states it
primary risk
RK01
D inferred by us from the described behaviour, reason shown
secondary risks
RK04
D inferred by us from the described behaviour, reason shown
control chain
layer: L3; party: deployer; control id: H2; outcome: got around; quote: Because Bing’s domains sit on Microsoft’s own allowlist, the outbound data transfer looked, to any enterprise data-loss-prevention tool watching the network, like ordinary traffic to a trusted Microsoft domain.; source index: 0
C one secondary source states it
remediations
kind: fix; controls added: J1; quote: Microsoft has since patched the issue on its servers, and no vendor has reported it being used in a real attack.; source index: 0
C one secondary source states it

Impact

Severity
moderate
D inferred by us from the described behaviour, reason shown
Kind of harm
privacy
C one secondary source states it
Kinds of data exposed
e-mail, calendar, chat messages, documents, authentication codes
C one secondary source states it
Why this severity
Bounded scope stated: the attacker never gained access to more than the victim already had, since the flaw was a disclosure bug and not privilege escalation.
C one secondary source states it

Notes on gaps

CVSS scores are disputed across sources and were not recorded.

LR-2026-0580 · version 1 · published 2026-11-01 after automatic checks; not yet checked field by field by a person · JSON