Microsoft last week fixed a critical vulnerability in M365 Copilot, the enterprise version of its artificial intelligence assistant built into Microsoft 365after researchers from the security firm Varonis demonstrated that it could be used to extract sensitive information from emails and files to which the system had access. The ruling, named SearchLeakallowed in a proof of concept recover two-step verification codes and other private data without the victim having to type any commands in Copilot.
The problem once again brings to the table one of the great weaknesses of assistants based on language models. These tools are not always able to confidently distinguish between a legitimate instruction given by the user and a malicious command hidden in an email, a web page or a link. In this case, the researchers took advantage of that weakness to make Copilot will search for information within the user’s Microsoft 365 environment and send it outside through a web request.
To exploit the SearchLeak vulnerability, the attacker sent the victim an email with a specially prepared link to the Microsoft 365 search function. Within that link was included a hidden instruction for Copilota technique known as ‘prompt injection’ or prompt injection. When the user clicked, the assistant interpreted that instruction as a valid order, it searched for data in accessible emails and tried to include it within the address of an image uploaded from the internet.
How the attacker bypassed AI security barriers
Microsoft has safety barriers designed precisely to prevent this type of leaks. One of them transforms Copilot’s output in plain text to prevent the browser from executing elements Html. Another limits the sites to which Copilot can send requests without express permission. However, the researchers discovered a time window when Copilot’s response was first generated as raw HTML before being protected by those measures. By the time the barrier acted, the request with the data I had already exited the browser.
The attack also bypassed another restriction by bingMicrosoft’s search engine. Since Bing was within the domains allowed by Copilot’s security policy, the researchers used it as an intermediary to redirect the request to a server controlled by the attacker. There, the information was recorded. In practice, this made a simple click on a link in a possible way to extract internal data from an organization.
The potential scope was especially sensitive because SearchLeak affected the enterprise level of Microsoft 365. That means it wasn’t just personal messages. Depending on the user’s permissions, the attack could expose emails, meeting invitations, notes, SharePoint documents, OneDrive files, and other content indexed within the company.
Microsoft has already fixed the specific vulnerabilities exploited by SearchLeakaccording to the researchers. Even so, the case reflects one of the biggest security problems of artificial intelligence. As long as models continue to have access to private data and are susceptible to prompt injections, companies will have to continue reinforcing your barriers to prevent a hidden order from turning into a leak or something worse.