Microsoft Copilot Flaw Poses Risk of Data Theft With One Click

WHO:

Mashable - Microsoft is the organization involved in the Copilot vulnerability.

Inc - Researchers discovered the exploit related to Microsoft Copilot.

WHAT:

Ars Technica - The SearchLeak exploit allows hackers to steal two-factor authentication (2FA) codes from users.

Mashable - A newly discovered vulnerability in Microsoft Copilot enables hackers to access emails and other sensitive data.

Inc - The exploit demonstrates how AI can exacerbate existing cybersecurity vulnerabilities.

TechRadar - Varonis identified a method to chain three bugs into one exploit that can lead to data exfiltration.

WHERE:

TechRadar - The data at risk includes information stored in inboxes, OneDrive, and SharePoint.

WHY:

Inc - The exploit highlights the potential for AI to make existing cybersecurity issues more severe.

HOW:

TechRadar - The method involves chaining three separate bugs to create a single exploit capable of data theft.

(UPDATED June 16, 2026 23:26 UTC)

A new exploit known as SearchLeak has emerged, enabling hackers to steal two-factor authentication codes from users. This vulnerability poses a significant risk to online security, as it undermines a key method of protecting accounts. Experts are urging users to remain vigilant and consider additional security measures to safeguard their information.

--

(UPDATED June 16, 2026 21:52 UTC)

A newly discovered vulnerability in Microsoft Copilot has raised significant concerns, as it allows hackers to access sensitive data, including emails stored in inboxes, OneDrive, and SharePoint. Researchers from Varonis have identified a method that chains together three separate bugs to create a single exploit capable of data exfiltration, demonstrating how AI can worsen existing cybersecurity vulnerabilities. This situation underscores the pressing need to address the potential risks associated with AI technologies in the realm of cybersecurity.