This Copilot vulnerability could expose emails, 2FA codes, and other sensitive data
Mashable
Cybersecurity researchers discovered a three-stage vulnerability called SearchLeak that allowed attackers to exfiltrate sensitive data from Microsoft 365 Copilot.Summary
Researchers at Varonis Threat Labs identified a vulnerability chain dubbed SearchLeak that compromised Microsoft 365 Copilot. By combining Parameter-to-Prompt injection with existing web flaws, attackers could bypass AI safeguards to extract sensitive information like emails, 2FA codes, and internal documents. Although the data was temporarily vulnerable during Copilot's response streaming, Microsoft has since patched the flaw.
(Source：Mashable)