SearchLeak: AI Search Is Now an Execution Boundary
The search box is no longer read-only.
SearchLeak showed that an enterprise AI search link can become an instruction channel, a renderer, and an exfiltration path in one motion. The security lesson is not about one patched bug. It is about treating AI search as an execution boundary.
On June 15, 2026, researchers disclosed SearchLeak, a vulnerability chain in Microsoft 365 Copilot Enterprise Search. Microsoft remediated it as CVE-2026-42824.
The attack is worth studying because it is not just another prompt injection headline. It combines one AI-native weakness with two classic web bugs:
- A search URL parameter becomes an instruction to the AI system.
- Streaming output briefly renders unsafe HTML before a guardrail neutralizes it.
- An allowlisted image search endpoint performs a server-side fetch to an attacker-controlled URL.
Individually, each link looks like a familiar engineering problem. Chained together, they turn one trusted enterprise link into a data exfiltration path from email, calendar, SharePoint, and OneDrive.
That is the part security teams should sit with: AI search is becoming a privileged action layer over the company.
The Chain In Plain English
The victim clicks a link to a real Microsoft 365 search domain. The link contains a crafted q parameter. That parameter is supposed to hold a natural-language search query, but the AI layer treats it as an instruction.
The instruction tells Copilot Enterprise Search to look across the signed-in user’s accessible data, extract sensitive content, and place it inside an image URL. During the streaming response, an image tag fires before output sanitization finishes. The page’s Content Security Policy would normally block an arbitrary attacker image domain, but a Microsoft-owned image search endpoint is allowlisted. That endpoint fetches the attacker URL server-side. The stolen value lands in the attacker’s web logs.
No plugin. No password prompt. No second click. No malicious binary.
The attacker did not break into the tenant. The AI feature did what it was allowed to do: search data the user could access and render an answer. The exploit lives in the gap between “answer” and “action.”
CISO translation
Enterprise AI search is not a passive retrieval feature once it can interpret URL parameters, traverse privileged data, generate markup, and trigger browser or server fetches. It is a compound execution surface.
Why The Old Mental Model Fails
Most organizations still think about search as a read path. Search retrieves. Search ranks. Search summarizes. If a search link points to a trusted domain, existing phishing filters and URL rewriting tools usually treat it as low risk.
SearchLeak breaks that model in three ways.
First, the query is not only data. In an AI search interface, a query can become an instruction. That is the parameter-to-prompt problem: an input field originally designed for intent expression becomes a place where an attacker can smuggle tasking.
Second, the response is not only text. AI interfaces stream partial output into a live client. If sanitization happens after generation rather than at the point of rendering, there is a timing window where active markup can execute. This is not a theoretical distinction. The browser does not wait for the assistant to be “done thinking” before it starts loading resources.
Third, CSP allowlists are not trust boundaries. An allowlisted domain that performs server-side fetches on user-controlled URLs can become an exfiltration bridge. The browser may obey policy while the backend quietly delivers the payload.
| Old assumption | What SearchLeak showed | Security implication |
|---|---|---|
| A search query is inert user intent. | A query parameter can become executable instruction. | Treat AI-facing parameters as instruction surfaces, not only input strings. |
| Sanitizing the final answer is enough. | Streaming output can create side effects before final sanitization. | Render-time isolation has to happen before any network-capable markup exists. |
| CSP blocks exfiltration to attacker infrastructure. | A trusted allowlist entry can perform the attacker fetch server-side. | Review allowlisted services for SSRF-like behavior, not just domain ownership. |
| User permissions limit the blast radius. | The attacker inherits the victim’s accessible graph through the AI layer. | Data minimization matters because every indexed object becomes reachable by future chains. |
The important point is not that every enterprise search product has this exact flaw. The point is that AI search collapses several security boundaries that used to be separate: query parsing, instruction following, data retrieval, response rendering, and outbound network behavior.
This Is The New Shape Of Agentic Risk
SearchLeak maps cleanly to the OWASP Top 10 for Agentic Applications 2026, even though it is not a fully autonomous agent running shell commands.
That matters. Security teams often draw a bright line between “agent” and “assistant.” The attacker does not care about that product taxonomy. The attacker cares whether the system can interpret instructions, access privileged context, and cause observable side effects.
Under the OWASP agentic lens:
- ASI01 applies because attacker-supplied text changes the system goal through the query parameter.
- ASI02 applies because built-in search and rendering capabilities become tools for unauthorized data movement.
- ASI03 applies because the attack runs through the victim’s enterprise data permissions.
- ASI06 applies because context and response construction are manipulated into carrying data across trust boundaries.
- ASI07 applies because defenders need telemetry that explains which prompt, source, and rendering step caused the side effect.
This is why AI security cannot be reduced to model behavior. The model is one component in a larger control plane. The browser, sanitizer, CSP, search index, identity graph, and server-side fetch behavior all become part of the exploit surface.
The Control Gap: Search Needs Policy
Traditional search security asks, “Can this user read this object?”
AI search security has to ask more:
- Can a URL parameter instruct the system to perform multi-step retrieval?
- Can the response contain active markup, links, images, or fetch-triggering constructs?
- Can generated content leave the browser or be fetched by a trusted backend?
- Can a user-initiated search access MFA codes, reset links, payroll files, board material, or acquisition plans?
- Can responders reconstruct the prompt, retrieved objects, rendered tokens, and outbound requests after the fact?
The missing layer is action policy around search. Not every AI search operation should be allowed to compose arbitrary results into network-capable output. Not every indexed data class should be retrievable by broad natural-language instructions. Not every trusted service should be allowed to fetch arbitrary user-supplied URLs.
Input policy
Classify AI-facing URL parameters as command surfaces. Reject or downgrade queries with encoded instructions, markup, extraction verbs, or outbound URL construction patterns.
Retrieval policy
Separate normal search from sensitive data retrieval. MFA messages, reset links, HR data, finance data, and confidential files need stronger handling than everyday documents.
Render policy
Sanitize before streaming into any network-capable context. Treat generated HTML, Markdown image tags, and rich previews as active content until proven inert.
Egress policy
Audit allowlisted domains for server-side fetch behavior. A trusted domain that dereferences attacker-controlled URLs is an exfiltration primitive.
What Security Teams Should Do This Quarter
Microsoft has patched SearchLeak, so this is not a “disable Copilot today” argument. The better question is whether your AI search and assistant surfaces have the same architectural class of exposure.
Start with six controls.
Practical rule
If an AI system can retrieve sensitive data and generate output that causes network requests, it needs the same policy treatment as an integration that can move data. Search is no longer just search.
The Bottom Line
SearchLeak is a clean example of the agentic security transition.
The breach path does not begin with malware. It begins with a normal link. It does not require new cryptography-breaking research. It chains old web weaknesses through an AI feature that can interpret intent, access privileged context, and generate side-effecting output.
That pattern will repeat. The specific products will change. The architecture pressure will not.
Security teams should stop asking only whether the model is safe. Ask whether the full AI search pipeline is safe: input, retrieval, generation, rendering, browser policy, server fetches, and audit.
The search box has become a control plane. Treat it like one.
References
- Original disclosure, June 15 2026: SearchLeak: How We Turned M365 Copilot Into a One-Click Data Exfiltration Weapon
- The Hacker News, June 15 2026: One-Click Microsoft 365 Copilot Flaw Could Have Let Attackers Steal Emails, Files, and MFA Codes
- Microsoft Security Response Center: CVE-2026-42824
- OWASP GenAI Security Project: OWASP Top 10 for Agentic Applications 2026
Rogue Security helps teams reason about AI permissions, tool behavior, and runtime data movement before agentic systems turn trusted workflows into attack paths. Learn more at rogue.security.