AI Security · AI-Powered Attack

Trusted Microsoft Links Can Smuggle Copilot Prompts

A real microsoft.com search link can carry instructions, not just a query, so the usual trust checks miss the attack before Copilot starts reading internal data. In SearchLeak, the user only clicks once; the link’s q parameter is treated like a prompt, and Copilot can be steered toward mailbox or file content that the user never typed out.

Varonis published a proof of concept for CVE-2026-42824, and Microsoft says it already applied backend mitigation. The chain affects Microsoft 365 Copilot Enterprise and Microsoft Copilot Enterprise Search, with exposed data including emails, calendar items, OneDrive files, SharePoint documents, and secrets such as MFA codes and passwords.

The risk is broader than one bug class. Any AI assistant that accepts instructions through links or prompts and can reach internal content inherits the same trust problem, even when the destination domain is legitimate.

5 sources · Jun 19

CVE-2026-42824

NVD KEV

CVSS 6.5 MEDIUM: improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an… EPSS 8% (94th percentile), up from 0.5%.

Timeline

Jun 19 Reported by CSO Online
Jun 16 Reported by Ars Technica Security
Jun 15 Reported by The Hacker News
CVE-2026-42824 EPSS surged to 8%

Sources

Jun 19 CSO Online
M365 Copilot SearchLeak: Your prompt injection attack surface just got bigger
Although not the first of its kind, researchers’ POC attack against Microsoft’s M365 Copilot Enterprise underscores parameter-to-prompt (P2P) injections as a potentially broad threat.
original
Jun 16 Ars Technica Security
Critical Copilot vulnerability allowed hackers to steal 2FA code from users
SearchLeak exploit shows why the industry's approach to LLM security fails over and over.
original
Jun 15 The Hacker News
One-Click Microsoft 365 Copilot Flaw Could Have Let Attackers Steal Emails, Files, and MFA Codes
Microsoft fixed a critical Copilot Enterprise Search flaw that could expose emails, calendars, and indexed files through one trusted link.
original

Vendor digest: Microsoft

Part of the PlainSec briefing for 2026-06-15

Every edition of this story: Trusted Microsoft Links Can Smuggle Copilot Prompts

AI Security · AI-Powered AttackTrusted Microsoft Links Can Smuggle Copilot PromptsA real microsoft.com search link can carry instructions, not just a query, so the usual trust checks miss the attack before Copilot starts reading internal data. In SearchLeak, the user only clicks once; the link’s q parameter is treated like a prompt, and Copilot can be steered toward mailbox or file content that the user never typed out.Varonis published a proof of concept for CVE-2026-42824, and Microsoft says it already applied backend mitigation. The chain affects Microsoft 365 Copilot Enterprise and Microsoft Copilot Enterprise Search, with exposed data including emails, calendar items, OneDrive files, SharePoint documents, and secrets such as MFA codes and passwords.The risk is broader than one bug class. Any AI assistant that accepts instructions through links or prompts and can reach internal content inherits the same trust problem, even when the destination domain is legitimate.5 sources · Jun 19

CVE-2026-42824

NVD KEV

CVSS 6.5 MEDIUM: improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an… EPSS 8% (94th percentile), up from 0.5%.

Timeline

Jun 19 Reported by CSO Online

Jun 16 Reported by Ars Technica Security

Jun 15 Reported by The Hacker News

CVE-2026-42824 EPSS surged to 8%

Sources

Jun 19 CSO Online

M365 Copilot SearchLeak: Your prompt injection attack surface just got bigger

Although not the first of its kind, researchers’ POC attack against Microsoft’s M365 Copilot Enterprise underscores parameter-to-prompt (P2P) injections as a potentially broad threat.

original

Jun 16 Ars Technica Security

Critical Copilot vulnerability allowed hackers to steal 2FA code from users

SearchLeak exploit shows why the industry's approach to LLM security fails over and over.

original

Jun 15 The Hacker News

One-Click Microsoft 365 Copilot Flaw Could Have Let Attackers Steal Emails, Files, and MFA Codes

Microsoft fixed a critical Copilot Enterprise Search flaw that could expose emails, calendars, and indexed files through one trusted link.

original

Vendor digest: MicrosoftPart of the PlainSec briefing for 2026-06-15Every edition of this story: Trusted Microsoft Links Can Smuggle Copilot Prompts