SearchLeak Shows How a Single Crafted URL Can Drain Your M365 Tenant
Varonis researchers chained three weaknesses in Copilot Enterprise Search into a full data-exfiltration path. Microsoft patched it. The attack class isn't going anywhere.
Key points
- Varonis Threat Labs named the technique parameter-to-prompt (P2P) injection: a crafted URL feeds a malicious prompt directly into the LLM behind Copilot Enterprise Search.
- Two Microsoft guardrails failed together: a sanitizer that only caught final output missed the model's thinking phase, and a Content Security Policy allow-listing
*.bing.comlet researchers proxy exfiltrated data through Bing Image Search. - The blast radius covers emails, meeting notes, OneDrive files, and SharePoint documents for any user the attacker can trick into clicking a link.
- Microsoft rated the flaw critical and patched it server-side earlier this month.
- The same URL-parameter injection pattern has shown up in Perplexity's Comet browser and in ChatGPT, so this is not a Microsoft-specific failure.
How does P2P injection actually work?
Copilot Enterprise Search accepts natural language via a ?q= URL parameter. Because that query feeds an LLM rather than a conventional search index, a sufficiently crafted URL becomes an instruction sheet. Tell the model to find a two-factor authentication code in the victim's inbox, store it in a variable, then embed that variable in an image tag pointing to an attacker-controlled server. One click. No credentials needed on the attacker's side.
"Because Copilot Enterprise operates with the user's full graph permissions, the attacker effectively inherits the victim's access to the organization's data, without ever authenticating," the Varonis researchers wrote.
Why did Microsoft's guardrails miss it?
The failure is layered in an instructive way. The first guardrail wrapped LLM output in <code> blocks to prevent HTML rendering, but that sanitization only covered the model's final output. Browsers render incrementally, so the HTML produced during the thinking phase hit the DOM before the sanitizer fired. Textbook race condition.
The second guardrail was a Content Security Policy on m365.cloud.microsoft.com restricting which external domains the page could pull resources from. *.bing.com was on the allow-list. Bing Image Search supports an imgurl= parameter that fetches images from arbitrary external URLs, so the researchers routed exfiltrated data through bing.com/images/searchbyimage as a proxy, staying inside the approved CSP domain the entire time.
Should you worry about similar flaws elsewhere?
Varonis separately disclosed a related path they're calling Reprompt in Copilot Personal. Researchers at LayerX found comparable q=-parameter injection in Perplexity's Comet browser last October, and Tenable published a similar ChatGPT vector in July 2025. We first covered Varonis's work on Copilot on 19 June 2026. The pattern is consistent enough that it belongs on every AI product team's threat model.
Common questions
What should platform engineers do right now?
Sanitize output at render time, not as a post-processing step after the stream closes. Audit CSP allow-lists for domains that accept arbitrary URL parameters, treating anything with server-side request forgery risk as a liability. Train users to treat URLs with long encoded query strings the way they'd treat a suspicious attachment.
Is this patched?
Microsoft patched the specific Copilot Enterprise Search flaw server-side earlier this month. The underlying P2P injection class is not patched anywhere because it isn't a bug in a single product.
Both guardrails were real. They just each assumed the browser would wait.
