Researchers uncover a critical flaw in Microsoft 365 Copilot Enterprise that could allow attackers to access private organisational data with a single click, highlighting growing risks in AI-assisted enterprise tools.
Microsoft 365 Copilot Enterprise has been shown to contain a flaw that could let an attacker reach private data with a single click, after researchers at Varonis persuaded the assistant itself to reveal the hidden mechanism behind the weakness. According to Ars Technica, the team set out to build an exploit that would run when a victim merely opened a link, bypassing the normal requirement for explicit user consent. Copilot initially rejected the idea, but repeated questioning exposed enough detail about its internal safeguards to uncover an undocumented parameter that disabled the consent check.
Varonis senior researcher Lior Adar told Ars Technica that each refusal became useful because it exposed more of the system’s structure. That questioning eventually led to a Microsoft trade secret: the parameter string “?autorun=1”. When paired with the better-known “?q=” search parameter, it caused the prompt to execute as soon as the target clicked the malicious link. Microsoft later reduced the risk in February by stopping “?q=” from inserting text directly into the chatbot input, although that change also altered how some browser integrations worked.
Security reports from AI Security Wire, TechRadar, Computing and Cyber-Ivy describe the broader exploit chain as a combination of three separate weaknesses, now tracked as CVE-2026-42824 and nicknamed “SearchLeak”. The chain reportedly combined parameter-to-prompt injection, an HTML rendering race condition and a Bing server-side request forgery that bypassed content security policy controls. Together, those flaws could expose mail, OneDrive, SharePoint and calendar data without further user action.
Microsoft has since deployed more comprehensive fixes and rated the issue at the highest severity level in its vulnerability handling. The case underlines a growing problem for enterprise AI systems: guardrails intended to block dangerous actions can themselves become a source of information for attackers when the model discloses too much about how those protections work. It also shows that prompt-based assistants, when connected to corporate data and browser automation, can create attack paths that resemble classic web security failures rather than ordinary chatbot misuse.
Disclaimer: This content is intended for informational purposes only. Readers are advised to exercise their own judgement, conduct due diligence, or consult a qualified expert before acting on any information provided.
