Copilot Vulnerability: Data Theft via "SearchLeak" Flaw

A new vulnerability chain turns Microsoft Copilot into a tool for data theft. This critical flaw combines three vulnerabilities, allowing attackers to steal sensitive information. Here's the thing: one key part is a new type of AI vulnerability called "Parameter-to-Prompt Injection." This makes Copilot serve up malicious links. When a user in a Copilot Enterprise tenant clicks on such a link, the AI helps steal emails, authorization codes, SharePoint and OneDrive files, and more. Microsoft has assigned this attack chain CVE-2026-42824 and issued a patch for Copilot Enterprise. The bottom line is that users of Copilot Enterprise should ensure their systems are updated to prevent this data theft.