Security researchers have exposed critical vulnerabilities in two widely used enterprise AI tools — Microsoft 365 Copilot and LiteLLM — highlighting a dangerous pattern: enterprise AI accepts external input with no trust boundary. The disclosures, published within days of each other, demonstrate that foundational security assumptions in AI-integrated software remain unaddressed.
On June 15, Varonis disclosed SearchLeak, tracked as CVE-2026-42824, a proof-of-concept exfiltration chain in Microsoft 365 Copilot Enterprise Search. An attacker sends a crafted microsoft.com URL; when a victim clicks it, Copilot searches their mailbox and data exfiltrates through a Bing SSRF. No plugins, no second click, and no visible indicator are required. Four days earlier, Obsidian Security published a three-CVE chain against LiteLLM that carried a default low-privilege user all the way to admin access and remote code execution.
The underlying vulnerability in both cases is the same: AI systems that parse external input treat it as inherently trusted. In Copilot, a URL's q parameter directly fed attacker instructions into the LLM, while a rendering race condition fired an image tag before the output sanitizer ran. For LiteLLM, default low-privilege credentials allowed an attacker to traverse the entire privilege ladder to admin and execute arbitrary code.
These findings represent a systemic market signal for enterprise security teams. As AI tools increasingly become the primary interface for corporate data, the attack surface has expanded beyond traditional endpoints. Both disclosures were made with proof-of-concept code, meaning exploitation is feasible for any motivated attacker. The pattern suggests that current deployment models for AI agents lack fundamental trust boundaries that conventional software has long enforced.
The incidents also raise questions about vendor response times. While Microsoft has yet to patch SearchLeak, the CVE designation indicates active acknowledgment. LiteLLM's maintainers pushed fixes rapidly after Obsidian's coordinated disclosure. The episode underscores that enterprise AI security currently relies on reactive patching rather than proactive architecture, and that organizations must audit their AI stack now rather than after an incident.