Researchers disclosed a critical vulnerability in Microsoft Copilot, dubbed SearchLeak, that enabled one-click data theft through a multi-stage prompt-injection attack. The flaw, now patched, leveraged hidden URLs and other variables to bypass safeguards and exfiltrate sensitive information.
The attack represents a growing class of AI security issues where adversaries manipulate large language models through indirect prompt injection. While Microsoft has addressed the specific vector, the technique underscores how integrated AI assistants expand the attack surface in enterprise environments.
SearchLeak operated in three stages: first, the attacker embedded malicious instructions in a hidden URL or web resource that Copilot would process. Next, the model's response to a user query would unknowingly include code or commands from that resource. Finally, the injected prompt triggered data exfiltration, sending stolen content to an attacker-controlled endpoint—all with a single user click.
Microsoft released a patch for the vulnerability before public disclosure, and no active exploitation has been confirmed in the wild. Organizations using Copilot are advised to ensure their instances are updated and to monitor for unusual outbound network traffic from AI tools.
The flaw is part of a broader trend of prompt-injection attacks targeting generative AI systems. Security experts note that as AI assistants gain greater access to enterprise data and APIs, the potential for similar data-leak techniques will increase, though Microsoft's rapid response demonstrates a maturing vulnerability-handling process for AI products.