Microsoft 365 Copilot Vulnerability

1. Microsoft 365 Copilot, the company's AI-powered productivity tool, has been found to have a critical vulnerability, dubbed SearchLeak, which could allow attackers to siphon off sensitive internal data, including active two-factor authentication codes, emails, and corporate files, with nothing more than a single user click [1]. The stakes for this kind of vulnerability are incredibly high in corporate environments, where an automated script scraping attacker logs could easily grab active multi-factor authorization codes or password reset links.

The SearchLeak Vulnerability

The SearchLeak exploit works by crafting a specific Microsoft 365 Copilot Search URL that includes malicious code, which, when clicked, allows the attacker to scan the victim's inbox, grab confidential items, and sneakily embed that data into a hidden image tag [1]. The vulnerability bypasses standard anti-phishing filters because the attack is delivered through a completely legitimate, trusted Microsoft domain link. Microsoft has mitigated the issue directly on its backend after receiving the report from Varonis Threat Labs [1].

Competitive Picture and Recent Developments

Meanwhile, Microsoft has announced the general availability of Copilot Cowork, its AI-powered agentic workspace, which is designed to handle complex and long-running tasks across multiple tools and data sources [3]. The feature, which was previously available through the company's Frontier preview program, is now rolling out worldwide for Microsoft 365 Copilot customers. More than half of the Fortune 500 companies have already used Copilot Cowork during the preview phase [3]. The company has also introduced spending controls, usage limits, and budget management tools to allow administrators to monitor and manage AI-related expenses [5].

What to Watch

• The rollout of Copilot Cowork to all Microsoft 365 Copilot customers
• The introduction of new features, including support for partner plugins and browser-based actions through Microsoft Edge
• The resolution of the recent Copilot outage, which affected users and was caused by a recent deployment issue [4]

The SearchLeak vulnerability and the recent outage highlight the importance of security and reliability in AI-powered productivity tools. As Microsoft continues to develop and roll out new features, such as Copilot Cowork, the company must ensure that its tools are secure and reliable to maintain user trust. The impact of these issues on Microsoft's competitive position in the market remains to be seen.