Microsoft Copilot SearchLeak patch closed Bing-trampoline exfiltration of 2FA tokens via prompt injection

Attackers sent victims a crafted M365 search URL containing instructions for Copilot to query the inbox, extract 2FA messages, and embed titles inside an img src attribute. The browser rendered the tag during the streaming response phase, issuing an outbound request to Bing before the final <code> wrapper applied. Bing's CSP allowance then forwarded the payload to an attacker domain.

Varonis researchers documented the chain in their Monday disclosure, confirming the blast radius included SharePoint, OneDrive, and any connected enterprise data. The temporary DOM render window existed because output sanitization ran after token generation rather than inside the model loop itself. This matches prior LLM agent bypass patterns seen in 2024-2025 where streaming APIs decoupled safety checks from initial HTML emission.

The root cause is architectural: any system granting Copilot read access to email while permitting external image fetches through approved domains creates an unavoidable side channel. Microsoft added stricter URL validation and delayed rendering, yet equivalent prompt-to-network paths remain open in other M365 copilots.

Enterprises should assume similar injection vectors will surface within six months and enforce per-user data scoping plus outbound URL allow-lists at the tenant level.