Critical Copilot vulnerability allowed hackers to steal 2FA code from users

Researchers disclosed "SearchLeak," a parameter-to-prompt injection against Microsoft Copilot/Search that allows an attacker to craft a URL which causes Copilot to render an <img> tag and issue HTTP requests that exfiltrate enterprise M365 content (emails, SharePoint, OneDrive, etc.) by relaying through permitted domains like Bing; Microsoft patched the exploited vulnerabilities but the underlying attack pattern could be reworked to bypass guardrails.