SearchLeak Chains Legacy Web Bugs into One-Click Copilot Data Exfiltration

Du'aine Davis

For awareness

• In June, Varonis disclosed “SearchLeak”, a critical vulnerability chain in Microsoft 365 Copilot Enterprise, remediated by Microsoft under CVE-2026-42824. The issue allowed one-click exfiltration of sensitive organisational data, including emails, meeting content, SharePoint/OneDrive files, and MFA/OTP codes, affecting any tenant user with access to Copilot-indexed data.
• The attack chains Parameter-to-Prompt injection, an HTML rendering race condition, and Bing-based SSRF. A crafted Microsoft search URL embeds a malicious prompt in the q parameter, coercing Copilot to retrieve internal data and format it into an outbound request. During response streaming, the browser renders this content before sanitisation, enabling silent exfiltration through trusted Microsoft infrastructure.
• Organisations should monitor for suspicious Copilot Search URLs containing encoded prompts, HTML tags, or data-embedding instructions. In Microsoft Defender/XDR, hunt for anomalous Copilot-driven access to email, SharePoint, or OneDrive followed by outbound requests, particularly involving Bing domains. Strengthen detections around abnormal AI-assisted search behaviour and treat AI-generated or streamed HTML as untrusted until sanitisation is complete.

SearchLeak: How We Turned M365 Copilot Into a One-Click Data Exfiltration Weapon

Du'aine Davis

Microsoft details AutoJack exploit chain in AutoGen Studio
For awareness

• On 18 June, Microsoft disclosed AutoJack, an exploit chain in AutoGen Studio’s development branch that could let untrusted web content rendered by a browsing AI agent trigger remote code execution on the host. The affected MCP WebSocket surface was not included in PyPI releases, limiting exposure to developers who built AutoGen Studio from GitHub before the hardening commit.
• The chain combined three weaknesses: localhost-origin trust, missing authentication on MCP WebSocket paths, and acceptance of server_params from a URL as executable command parameters. A malicious webpage rendered by a local browsing agent could open a WebSocket to AutoGen Studio and cause it to spawn attacker-supplied commands under the developer’s account. No specific threat actor was attributed.
• Organisations are advised to run AutoGen Studio only as an isolated developer prototype, use builds at or after commit b047730, avoid running browsing/code-execution agents beside privileged local services, enforce authentication on all control-plane routes, allowlist MCP executables, and use low-privilege sandboxes or containers. In Microsoft Defender XDR, hunt for AutoGen Studio spawning suspicious children such as powershell.exe, cmd.exe, bash.exe, or WebSocket activity to /api/mcp/ws/ with server_params.

AutoJack: How a single page can RCE the host running your AI agent  | Microsoft Security Blog