Trusted Microsoft Links Can Smuggle Copilot Prompts
A real microsoft.com search link can carry instructions, not just a query, so the usual trust checks miss the attack before Copilot starts reading internal data. In SearchLeak, the user only clicks once; the link’s q parameter is treated like a prompt, and Copilot can be steered toward mailbox or file content that the user never typed out.
Varonis published a proof of concept for CVE-2026-42824, and Microsoft says it already applied backend mitigation. The chain affects Microsoft 365 Copilot Enterprise and Microsoft Copilot Enterprise Search, with exposed data including emails, calendar items, OneDrive files, SharePoint documents, and secrets such as MFA codes and passwords.
The risk is broader than one bug class. Any AI assistant that accepts instructions through links or prompts and can reach internal content inherits the same trust problem, even when the destination domain is legitimate.