SearchLeak Shows How a Single Crafted URL Can Drain Your M365 Tenant

Microsoft patched a critical information-disclosure flaw in M365 Copilot Enterprise Search earlier this month, but the technique researchers used to exploit it — which Varonis Threat Labs is calling parameter-to-prompt (P2P) injection — describes a problem baked into how AI-powered search works at the protocol level.

The short version: Copilot Enterprise Search accepts natural language via a ?q= URL parameter. That's it. That's the attack surface.

Because the query parameter feeds directly into an LLM instead of a conventional search index, a sufficiently crafted URL becomes an instruction sheet. Tell the model to find a two-factor authentication code in the victim's inbox, store it in a variable, and embed that variable in an image tag pointing to an attacker-controlled server. One click from the victim. No authentication required on the attacker's side.

"Because Copilot Enterprise operates with the user's full graph permissions, the attacker effectively inherits the victim's access to the organization's data, without ever authenticating," the Varonis researchers wrote.

The failure mode here is layered in an instructive way. Microsoft had two guardrails in place. The first wrapped LLM output in <code> blocks to prevent HTML rendering — but that sanitization only applied to the model's final output, not the thinking phase. Browsers render incrementally. The HTML in the thinking phase hit the DOM before the sanitizer fired. Textbook race condition.

The second guardrail was a Content Security Policy on m365.cloud.microsoft.com that restricted which external domains the page could pull resources from. *.bing.com was on the allow-list. Bing Image Search supports an imgurl= parameter that fetches images from arbitrary external URLs. So the researchers routed the exfil through bing.com/images/searchbyimage as a proxy, staying entirely within the approved CSP domain while the data walked out the door.

In practice, any enterprise using M365 Copilot in a tenant where Exchange, SharePoint, and OneDrive are indexed — which is most of them — had a blast radius covering emails, meeting notes, OneDrive files, and SharePoint documents. The researchers note that depending on how M365 connects to the broader environment, it could go further.

This isn't isolated to Microsoft. Varonis previously disclosed a similar path in Copilot Personal, which they're calling Reprompt. Researchers at other firms have found comparable q=-parameter injection vectors in Perplexity's Comet browser and in ChatGPT. The pattern is consistent enough that it should be on every AI product team's threat model.

For platform engineers deploying these services, the operational surface is clear. Sanitize output at render time, not as a post-processing step applied after the stream closes. Audit your CSP allow-lists for domains that accept arbitrary URL parameters — anything resembling server-side request forgery risk deserves a second look. Train users to treat URLs with long encoded query strings the way they'd treat a suspicious attachment.

One thing the post-mortem will say: the guardrails were real, they just both assumed the browser would wait.