SearchLeak

SearchLeak is a proof-of-concept attack chain that exploits prompt injection vulnerabilities in Microsoft 365 Copilot Enterprise Search to enable one-click data theft of emails, calendar entries, and indexed files.

Why it’s in the news: It is in the news because security researchers publicly disclosed the vulnerability, demonstrating a significant security risk in the M365 Copilot service.

Latest on SearchLeak

• M365 Copilot SearchLeak: Your prompt injection attack surface just got bigger
• Copilot 'SearchLeak' Attack Allows 1-Click Data Theft
• A single click on a Microsoft link could have drained your inbox. Here’s how SearchLeak worked.
• Security researchers demonstrated a proof-of-concept attack called SearchLeak against Microsoft's M365 Copilot Enterprise that exploits prompt injection vulnerabilities.
• Varonis Threat Labs disclosed a vulnerability chain in Microsoft 365 Copilot Enterprise Search that could have allowed attackers to steal emails, calendar entries, and indexed files through a single click.

Connections

2 entities linked to SearchLeak across the news graph.