One-Click Microsoft 365 Copilot Flaw Could Have Let Attackers Steal Emails, Files, and MFA Codes

**SearchLeak:** Varonis chained a prompt-injection in Copilot Enterprise Search with a streaming sanitizer race and a CSP allowlist to exfiltrate mailbox, calendar and indexed files via Bing image fetches; Microsoft assigned CVE-2026-42824 and mitigated the flaw server-side, and Varonis published a PoC with no observed exploitation.