SearchLeak: How a microsoft.com Link Could Have Drained a Copilot Tenant

Key points

• Varonis Threat Labs chained three bugs into a one-click data-theft route they call SearchLeak.
• The attack lure pointed to a real microsoft.com domain, bypassing standard URL filtering and phishing tools.
• Copilot Enterprise Search exposed emails, calendar entries, and indexed files to attacker-controlled queries.
• Microsoft has fixed the issues server-side; customers need no patch and there's no evidence of in-the-wild exploitation.
• Admins should audit what Copilot has indexed and treat AI retrieval layers as sensitive-data sinks.

A click on a real microsoft.com link should not empty your inbox. For a window of time, against Microsoft 365 Copilot Enterprise Search, it could.

Varonis Threat Labs strung three bugs into a one-click exfiltration path called SearchLeak. The lure resolved to a legitimate Microsoft domain, so URL reputation engines had nothing to bite on.

What makes this different from a standard redirect attack?

If the pattern sounds familiar, it should: this is open-redirect logic wearing a Copilot badge. The primitive isn't novel. What sits behind that trusted hostname is. Enterprise Search in Copilot acts as a pre-authenticated oracle over a user's Graph data, giving an attacker with even a narrow query channel access to emails, calendar invites, SharePoint files, and anything else the index has chewed through.

Defenders have spent a decade training users to check the domain bar. SearchLeak punishes anyone who took that advice literally. The link is microsoft.com; the destination is hostile. It's the same logic as classic OAuth consent phishing and Azure AD app-registration abuse, just with a Copilot retrieval layer bolted on. We covered a related Copilot data-handling concern on 28 May 2026 in "Microsoft Wires Agentic AI Into Edge for Business, With an Audit Leash Attached", where Microsoft's own Purview controls were doing the work admins couldn't do manually.

Should you worry?

Microsoft fixed the underlying issues server-side. There's no customer patch to deploy and, per the Varonis disclosure, no evidence of exploitation in the wild. Tenants don't need to roll credentials over this one.

They should still draw the lesson. Audit what Copilot Enterprise Search has actually indexed in your tenant: most admins underestimate this by a lot. Treat Copilot and other RAG-style assistants (systems that retrieve live data to answer queries) as a sensitive-data sink in your DLP and insider-risk models, not a productivity feature that sits outside the threat model.

What comes next?

The broader pattern isn't going away. Any AI assistant that pairs broad read scopes with a web-facing surface is a high-value target. SearchLeak is the cleanest public example so far of a retrieval layer turned into an attacker-controlled query channel. It won't be the last: our piece on OpenAI's Lockdown Mode from 9 June 2026 made exactly that point, noting that vendor-side containment reduces AI-enabled exfiltration without stopping it.

The research question worth watching is whether vendors start treating retrieval indices the way the industry eventually learned to treat session cookies: as crown-jewel material with its own threat model, not a side effect of a feature ship.