Vulnerability in Microsoft Copilot Allowed Stealing Two-Factor Authentication Codes

Security researchers revealed a critical vulnerability in Microsoft Copilot called SearchLeak: attackers could silently steal one-time two-factor authentication codes directly from the victim's email—without any visible signs of compromise and without user participation.

How the exploit worked

At the core of the attack is prompt injection, one of the most studied yet unsolved threat classes for LLM systems. The mechanics are simple and therefore especially dangerous: an attacker sends the victim what looks like an ordinary email, inside which malicious instructions are hidden—disguised as text or HTML content. When Microsoft Copilot processes this email in the course of its routine tasks—summarizing incoming messages, responding to user requests, or simply updating mail indices—the embedded instructions seize control of the assistant.

Everything that follows works against the victim: Copilot, having full access to the Microsoft 365 ecosystem—email, OneDrive, Teams, calendar—on command from the malicious email performed targeted searches for queries like "confirmation code," "verification code," or "OTP." Found messages—typically emails from banks, corporate systems, or online services with active one-time passwords—were transferred to the attacker via a pre-prepared exfiltration channel. It's this mechanism that gave the attack its name, SearchLeak: leakage through search.

Everything happens invisibly—Copilot behaves normally, no warnings.

Why this repeats again

SearchLeak is not the first such incident with LLM products integrated into work environments. The problem is not a specific Microsoft developer error—it's architectural: the LLM receives unrestricted access to user data without strict isolation and without distinguishing "own" content from "external." Key vulnerable points exploited by this class of attacks:

• LLM processes untrusted content—emails, documents from third parties—with the same privileges as account owner instructions
• Search and summarization provide the model wide access to personal and corporate data
• Exfiltration mechanisms—forming external URLs, hidden HTTP requests—often aren't filtered by the system
• No strict distinction between "trusted user instruction" and "content received from external source"

Similar vulnerabilities have already been fixed in ChatGPT Plugins, Google Gemini for Workspace, and other AI assistants with expanded data access. The pattern is one and the same: the wider the integration—the larger the attack surface.

Microsoft's position

According to Ars Technica, researchers disclosed the vulnerability to Microsoft through coordinated disclosure—before the article's publication. The company released a patch, however technical details of protective measures remain undisclosed.

"SearchLeak clearly shows: you cannot give LLMs access to sensitive

data without strict sandbox restrictions," emphasize the research authors.

Microsoft positions Copilot precisely through its deep integration with email, Teams, files, and calendar—this is the product's core value proposition. And it creates structural risk: refusing integration would mean losing the product's value, building isolation is difficult but necessary.

What this means

As AI assistants receive ever-wider access to corporate data, prompt injection attacks will repeat—this is not a bug of a particular product but a structural problem for the entire industry. Corporate users should reconsider the level of Copilot's access to email and sensitive data, and AI product developers should seriously tackle the standard of isolating LLMs from external untrusted content.