Microsoft Copilot Flaw Let Attackers Steal Two-Factor Authentication Codes

Security researchers have disclosed a critical vulnerability in Microsoft Copilot called SearchLeak: attackers could quietly steal one-time two-factor authentication codes straight from a victim's email, with no obvious signs of a breach and without any involvement from the user.

How the exploit worked

The attack rests on prompt injection, one of the most studied yet still unsolved classes of threats to LLM systems. The mechanism is simple, which makes it especially dangerous: the attacker sends the victim an ordinary-looking email with malicious instructions hidden inside, disguised as text or HTML content. When Microsoft Copilot processes the email during its routine tasks, such as summarizing the inbox, answering a user's query or simply updating the mail index, the embedded instructions take control of the assistant.

From there, everything works against the victim. Copilot has full access to the Microsoft 365 ecosystem (email, OneDrive, Teams, calendar), and on the command of the malicious email it ran targeted searches for queries such as "код подтверждения", "verification code" or "OTP". The messages it found, typically emails from banks, corporate systems or online services containing valid one-time passwords, were sent to the attacker through a pre-prepared exfiltration channel. This mechanism gave SearchLeak its name: leakage via search.

Everything happens silently. Copilot behaves as usual, and no warnings appear.

Why this keeps happening

SearchLeak is not the first such case involving LLM products integrated into work environments. The problem is not a specific mistake by Microsoft's developers. It is architectural: an LLM gets unrestricted access to user data without strict isolation and without separating "own" content from "foreign" content.

The key weak points this class of attacks exploits:

• The LLM processes untrusted content, such as emails and documents from third parties, with the same privileges as the account owner's instructions
• Search and summarization give the model broad access to personal and corporate data
• Exfiltration mechanisms, such as building external URLs and hidden HTTP requests, are often not filtered by the system
• There is no strict boundary between a "trusted user instruction" and "content that arrived from an external source"

Similar vulnerabilities have already been documented in ChatGPT Plugins, Google Gemini for Workspace and other AI assistants with extended data access. The pattern is the same: the broader the integration, the larger the attack surface.

Microsoft's position

According to Ars Technica, the researchers disclosed the vulnerability to Microsoft through a coordinated disclosure procedure, before publication. The company released a patch, but the technical details of the protective measures remain undisclosed.

"SearchLeak clearly shows that LLMs must not be given access to

sensitive data without strict sandbox restrictions," the study's authors stress.

Microsoft positions Copilot precisely on its deep integration with email, Teams, files and calendar; that is the product's core value proposition. It is also what creates the structural risk: dropping the integration would defeat the point of the product, and building isolation is hard but necessary.

What this means

As long as AI assistants gain ever broader access to corporate data, prompt injection attacks will keep recurring. This is not a bug in one product but a structural problem for the whole industry. Enterprise users should review how much access Copilot has to email and sensitive data, and AI product developers should get serious about a standard for isolating LLMs from external untrusted content.