SearchLeak a single click exposes calendars and files using Copilot and Bing

Varonis Threat Labs researchers demonstrated an exfiltration path that required only a click on a legitimate Microsoft link and that, in power, could have removed mail issues, calendar details and routes to files indexed by Copilot Enterprise Search. Varonis baptized the chain of failures as SearchLeak and described it as the combination of three problems: an injection of parameters that becomes instructions for the Copilot engine, a career condition that allows the execution of HTML in the output flow before being sanitized and a second stage that takes advantage of the content security policy and the ability of the Google image service to recover data from Microsoft infrastructure.

The central part of the problem is that Copilot interprets the q parameter of the search URL as a natural * prompt * - not just a search chain - which allows an attacker to build a URL that orders Copilot to search within the mailbox or index and place the result within an image URL. Because the platform transmits the output in real time, the browser can start the embedded application (e.g. a < img >) before the answer passes through the safety wrapper that transforms it into text. As the domain content policy allows requests from bing.com subdomains, Bing acts unintentionally as a proxy: its "Search by Image" service will search for the URL indicated and thus drag the information out of the user's environment.

This explains why traditional measures such as URL filters or domain-based phishing detectors would not have helped: the link pointed to a legitimate microsoft.com domain and the final exfiltration is produced from the Bing infrastructure, outside the context of the user's browser. The impact is that the attacker inherits the access scope of Copilot for the affected user (i.e. what Microsoft Graph is allowed to read) without the need to authenticate or further interaction, and in seconds could capture single-use codes, re-establishment links, mail issues or references to sensitive files.

Microsoft assigned vulnerability as CVE-2026-42824 and reported an applied mitigation in the service backend; Varonis presented a concept test but did not report active exploitation in real environments. This incident again shows that the combination of old types of errors (race conditions, SSRF / sanitizers) with new architectures based on prompt processing can revive vectors that were thought to be mitigated.

To better understand the key part of the defense that was evaded, it is appropriate to review how content security policy works and why a broad allowlist of trust domains can be counterproductive when the third service makes server-side requests: the technical documentation in MDN on Content Security Policy clarifies the scope and limitations of these rules https: / / develop.mozilla.org / en-US / docs / Web / HTTP / CSP. Also, to assess how far Copilot can get via programming, administrators must remember that their integrations are based on Microsoft Graphh and on delegated permits, which are documented in the official guide https: / / learn.microsoft.com / en-us / graph / overview. Varonis maintains coverage and threat analysis on his blog that contextualizes this type of findings https: / / www.varonis.com / blog /.

What security teams can do today: first, confirm that the Microsoft-applied mitigation is in place and review any official communication from the supplier. In parallel, it is appropriate to implement specific detection in the records: to search for Copilot Search URLs with the q parameter containing coded payloads or HTML, and to monitor outgoing requests to Google's image endpoints from the context of end users or API. Reduce surface is critical: limit which Copilot data sets can indexe (sensitive data, MFA mailboxes or single-use codes), apply conditional access policies for high-risk sessions and restrict access to Microsoft Graphh applications with the principle of less privilege.

If an organization needs immediate containment measures, temporarily disable the features of Copilot that carry out automatic searches in indexed content for high-risk users or in administrative accounts is an acceptable defensive option until additional controls are verified. It is also prudent to review the retention and availability of login (to be able to track exfiltrations in minute windows) and to raise alerts on any abnormal access pattern to Bing or other services that act as proxy.

From the point of view of the supplier and of the safe design, the lessons learned are clear: the sanitation must be effectively applied at the point of departure of the stream, not only at the end of the processing; the CSP allowlists must be designed with the premise that third parties can act on behalf of the user; and the models that "run" prompts extracted from URL parameters need strict limits on what operations they can order and on what data sets they can act on. The community and response teams must also harmonize metrics and communications: discrepancies in CVSS scores and different public interpretations create confusion in the operational response.

In short, SearchLeak is a powerful reminder that the managed platforms and IA-driven assistants introduce new risk frameworks where old vulnerabilities fit into complex chains. Effective defence combines supplier mitigation, access controls and behavior-focused detection; the security equipment applying these layers will drastically reduce the opportunity window for single-click attacks.