Microsoft 365 Copilot's vulnerability, dubbed SearchLeak, poses a significant threat to enterprise security. This one-click exploit allows attackers to exfiltrate sensitive data, including emails, files, and MFA codes, by leveraging three interconnected bugs. The q parameter in the Copilot Enterprise Search URL is manipulated to instruct Copilot to search for and embed sensitive information in an image URL, which is then retrieved by Bing's infrastructure. This vulnerability highlights the importance of data-access governance and the need for organizations to closely monitor Copilot Search URLs and outbound requests to Bing's image endpoints. The potential impact of this exploit underscores the critical nature of addressing these vulnerabilities to protect sensitive information.
