One click on a normal Microsoft link and Copilot quietly ships emails, calendar, and files to an attacker. No password, ...

One click on a normal Microsoft link and Copilot quietly ships emails, calendar, and files to an attacker. No password, no second click.Varonis disclosed this 15 June 2026 — three chained bugs in M365 Copilot Enterprise Search they call SearchLeak. The link smuggles hidden instructions into Copilot, which follows them and hides stolen data in an image request. The safety check wraps the response a beat too late. Microsoft mitigated it server-side.#Cybersecurity #AIhttps://youtu.be/Na8yIP-KP-Q