▲ Peaking Technology

New attack turned Microsoft 365 Copilot into 1-click data theft tool

Microsoft 365 Copilot flaw exposed: attackers could steal emails, files, and MFA codes with a single click

3sources

3articles

7velocity

+0%since first seen

2h agofirst detected

Velocity

How fast coverage is spreading — measured hourly from article rate × source diversity. How this works →

The brief

The flaw enabled one-click theft of emails, documents, and multi-factor authentication (MFA) codes by manipulating Copilot’s search functionality. Coverage highlights the severity of the issue, with reports from *The Hacker News*, *BleepingComputer*, and *The420.in* emphasizing the potential for widespread corporate data breaches if left unpatched.

Microsoft’s response included urgent updates across its enterprise suite, though details on the scope of exploitation remain unclear. Security firms are expected to release deeper technical breakdowns, while Microsoft may face scrutiny over Copilot’s security safeguards.

Watch for updates on whether similar vulnerabilities exist in other AI-driven enterprise tools.

Synthesized by PULSE from the headlines below under a strict no-invention contract. ✓ fact-checked: unsupported claims removed (56% supported) Updated 41m ago.

Quick answers

What exactly was the SearchLeak flaw?

A critical vulnerability in Microsoft 365 Copilot that allowed attackers to manipulate its search function to steal emails, files, and MFA codes with a single click, according to security reports.

Has Microsoft confirmed how many users were affected?

Coverage does not yet specify the number of impacted users, but the flaw required patching across Microsoft 365 Copilot deployments.

Are there other AI tools at risk from similar flaws?

While the flaw is specific to Microsoft 365 Copilot, security experts may investigate whether comparable risks exist in other AI-powered enterprise tools.