SearchLeak and the Copilot Exfiltration Class: One Click, Your Mailbox, and PHI Out the Door

Until recently, the conversation about AI risk for regulated mid-market organizations was about shadow tools, agents nobody inventoried, running on infrastructure nobody owned. SearchLeak moves the conversation somewhere harder. The vulnerable system here is not shadow IT. It is Microsoft 365 Copilot, the sanctioned, licensed, IT-approved assistant your organization paid to deploy across its mailboxes. On June 15, Varonis Threat Labs disclosed CVE-2026-42824, a one-click exfiltration flaw that uses Copilot's legitimate access to read a user's mail, including multi-factor authentication codes, salary data, and M&A documents, and ship it out of the tenant through infrastructure Microsoft itself allowlists. For a behavioral health nonprofit, a regulated SaaS company, or a PE portfolio business running Copilot over inboxes that carry PHI, claims data, or deal terms, this is not an abstract research finding. It is a credentialed data path out of your environment that your existing DLP and egress controls were never designed to see. The data that moves is your most sensitive, and the channel it moves through is one you have explicitly trusted, and that combination is what turns a clever exploit into a reportable breach. What SearchLeak actually does EchoLeak, the first member of this class, established the pattern: an attacker plants instructions inside content Copilot will read, an email body, a document, a calendar invite, and Copilot, unable to distinguish data from command, follows them. SearchLeak is the second member, and it is meaner in two ways. First, it is one click. The victim does not have to compose a prompt or paste anything. A crafted message arrives; the user opens it or asks Copilot a routine question that causes the assistant to ingest the malicious content; the injected instructions execute with the user's own permissions. Copilot has standing access to that mailbox, so it can read MFA codes sitting in recent mail, compensation details in an HR thread, or the data-room link in an M&A chain. Second, and this is the part that defeats the controls most mid-market teams rely on, the exfiltration travels over allowlisted infrastructure. The data is encoded into requests that resolve to domains Microsoft's own services use and that your firewall, secure web gateway, and SaaS egress rules treat as trusted by default. There is no anomalous outbound connection to a sketchy IP. There is traffic to Microsoft-adjacent endpoints, which is exactly what you expect Copilot to generate all day. The smuggling happens inside the noise of normal operation. Why the old control model misses it Three assumptions in a typical mid-market security stack quietly fail here. The first is that data loss prevention watches the egress. Most DLP is tuned to catch a human attaching a spreadsheet to a personal Gmail, or a bulk download. SearchLeak produces neither. The "user" moving the data is an AI agent acting within policy, and the destination is an allowlisted domain. The pattern your DLP is trained to flag never appears. The second is that least privilege is enforced at the human level. Copilot inherits the full permission set of the person it runs as. If a clinician can read a mailbox full of PHI, so can the agent acting on their behalf, and the agent will do it without the human judgment that would make a person pause at an odd request. This is the same structural problem the Cloud Security Alliance flagged in its May non-human-identity governance whitepaper: machine identities now outnumber humans by roughly 45 to 1, and up to 144 to 1 in some estimates. Copilot is one more non-human principal with broad standing access and no independent authorization boundary. The third is that prompt injection is a content-filtering problem you can solve with a better classifier. OWASP's June agentic-AI Top 10 mapped prompt injection to six of its ten categories, it is not one risk, it is the connective tissue across most of them. You cannot filter your way out of a model that treats every byte it reads as potential instruction. You have to constrain what the agent can reach and where its output can go. What the audit and the regulator will ask When this surfaces in an assessment, HIPAA, a SOC 2 examination, a state privacy review, or a PE diligence pass, the questions are predictable, and you want answers ready before they are asked. Can you produce a log of every document and mailbox Copilot accessed on behalf of a given user over a given window? Can you show what data Copilot returned and where any agent-initiated output was sent? Do you have a tenant-level inventory of which mailboxes and SharePoint sites are in Copilot's grounding scope, and which of those contain PHI or other regulated data? If exfiltration occurred, can you scope the affected records, the exact population, for a breach-notification determination, or are you guessing? And can you demonstrate that an injection-borne data movement would have generated an alert rather than dissolving into normal Microsoft traffic? If the honest answer to the scoping question is "we cannot reconstruct what Copilot touched," you do not have a hardening gap. You have a breach-notification gap, because under most regimes the inability to rule out exposure is treated as exposure. The Purview-anchored response The audit trail SearchLeak demands runs through tooling large M365 tenants already license. Microsoft Purview is where the response lives, and it doubles as the evidence you will hand an examiner. Our existing field guide, M365 Compliance and Audit Readiness with Purview, walks the configuration in depth; the SearchLeak-specific moves layer on top of it. A minimum Copilot hardening checklist for a regulated tenant: Scope grounding. Use sensitivity labels and SharePoint/Exchange restrictions so Copilot cannot ground on PHI- or deal-bearing repositories a given user has no business reason to query. Default-deny, then add back. Label and DLP the output path. Extend Purview sensitivity labels and DLP policies to Copilot interactions, and apply oversharing controls so the agent cannot surface or move labeled content beyond policy. Force the audit trail. Confirm Copilot interaction logging flows into Purview Audit and Compliance Manager with retention that survives a notification timeline, you need months, not days. Narrow the allowlist. Revisit the assumption that all Microsoft-adjacent egress is safe. Tighten the destinations Copilot traffic is permitted to reach so the exfiltration channel loses its cover. Constrain the principal. Treat Copilot as a non-human identity: scope its effective permissions tighter than the human's where you can, and review them on the same cadence as your service accounts. What we recommend For regulated mid-market teams running Copilot, four concrete moves this quarter. First, run a Copilot exposure inventory. Document every mailbox, site, and data source in grounding scope, and tag which hold regulated data. You cannot defend a surface you have not mapped, and this artifact is the first thing an auditor will want. Second, validate the Purview audit trail with a live test. Have a user invoke Copilot against a known sensitive document and confirm you can reconstruct the access from logs end to end. If you cannot, fix that before anything else, it is your breach-scoping capability. Third, rehearse the notification decision. Walk the tabletop: SearchLeak-style exfiltration is suspected, and under some frameworks the clock runs as short as 72 hours, who decides, on what evidence, and can you scope the affected population from real data? Fourth, fold Copilot into your non-human-identity governance rather than treating it as a feature. It is a credentialed principal with broad reach and no human judgment. This is the kind of work we do with regulated mid-market clients in a fixed-scope Diagnostic: map the Copilot surface, test the Purview trail, and leave you with the written artifact an examiner will accept. Copilot is not shadow AI. It is a trusted agent with the keys to your most regulated data, start treating it like one before the next exfiltration class arrives.