Microsoft 365 Copilot Flaws Expose Corporate Emails and One-Time Codes in One Click
Security researchers chained three bugs in Microsoft 365 Copilot’s enterprise search to pull emails, calendar entries, indexed files, and even one-time passcodes from targeted accounts. The attack needed just one click on a trusted Microsoft link, turning a flagship AI productivity tool into a high‑value espionage risk for governments and companies.
A set of vulnerabilities in Microsoft’s flagship AI assistant for business has revealed how quickly productivity tools can become intelligence tools — for the wrong side. Security researchers have disclosed that three chained flaws in Microsoft 365 Copilot Enterprise Search allowed an attacker, with a single trusted link, to siphon off sensitive corporate data including emails, calendars, indexed files and one-time authentication codes.
According to the researchers’ public description, the exploit did not rely on classic phishing tricks such as fake login pages or obvious credential theft. Instead, it leveraged how Copilot’s enterprise search function handles internal Microsoft links and authorization flows. One carefully crafted link, presented as legitimate Microsoft content, was enough to trigger Copilot into retrieving and exposing data from the victim’s environment that should have remained shielded behind corporate access controls.
The kinds of information exposed go to the heart of corporate and governmental operations: email correspondence between executives and partners; calendar entries that can reveal travel plans, internal meetings or negotiations; documents and files indexed by the enterprise; and critically, one-time codes that some organizations use as part of multi-factor authentication. In the wrong hands, that data is a roadmap for espionage, social engineering and follow-on intrusions.
For employees, the risk is unnervingly simple: clicking on what looks like a standard Microsoft link — something they have been trained for years to treat as safe — could have opened a window into their entire digital work life without any obvious sign something was wrong. Attackers would not need victims to type passwords into a bogus site or approve suspicious prompts; the AI system itself became the broker of access.
At the operational level, this kind of flaw challenges core assumptions about "zero trust" and internal segmentation. Many organizations have begun to centralize knowledge and documents into AI-augmented search tools on the promise of efficiency. That consolidation means a breach of the AI layer can act as a breach of everything it can see. An adversary that compromises a single Copilot session might not just read one mailbox but pivot across projects, departments and even subsidiaries, depending on how permissions are mapped.
For intelligence and defense communities, the implications extend beyond corporate IP theft. Governments are also experimenting with AI assistants to summarize cables, search classified repositories, and help staff manage workload. The Microsoft 365 Copilot flaws, while disclosed in an enterprise context, are a warning shot: a misconfigured or vulnerable AI layer tied into sensitive networks can quietly exfiltrate material at the speed of a search query.
The broader pattern is that AI-powered platforms are collapsing traditional lines between application, identity, and data — and attackers are adapting just as quickly. An exploit that once would have required multiple stages of phishing, credential harvesting and lateral movement can now, in some cases, be reduced to persuading a target to open a single link in the right environment. The risk is no longer theoretical; researchers have demonstrated it step by step.
The standout insight from this episode is blunt: when an AI assistant can see across your organization, any flaw in that assistant becomes a single point of strategic failure. Protecting that layer is no longer a convenience issue; it is a matter of corporate survival and, for some, national security.
What to watch next will be how quickly Microsoft patches and hardens Copilot’s authorization and search boundaries, whether regulators or data protection authorities demand disclosures from affected customers, and how other vendors audit their own AI integrations for similar cross-domain access risks. Security teams will also be reassessing training and access policies, knowing that "don’t click suspicious links" is no longer enough guidance when the danger can hide behind a familiar logo.
Sources
- OSINT