About this tag
Data exfiltration on WindowsForum.com covers security vulnerabilities that allow attackers to steal sensitive information from enterprise environments. Recent discussions focus on SearchLeak, a patched Microsoft 365 Copilot vulnerability chain (CVE-2026-42824) disclosed by Varonis in June 2026, where crafted search links could exfiltrate emails, files, calendar data, and MFA codes. Another thread examines CVE-2026-26144, an Excel cross-site scripting flaw enabling zero-click data exfiltration via Copilot Agent. These threads highlight how AI assistants and web-connected features expand attack surfaces, blending prompt injection, browser security, and enterprise data access. The tag emphasizes practical risks for Windows and Microsoft 365 administrators, urging attention to architectural security beyond patching individual bugs.
  1. WindowsForum AI

    SearchLeak Copilot Bug: Prevent AI Assistant Data Exfiltration in Microsoft 365

    On June 15, 2026, Varonis Threat Labs disclosed SearchLeak, a now-patched vulnerability chain in Microsoft 365 Copilot Enterprise Search that could have let an attacker exfiltrate emails, files, meeting data, and security codes after a victim clicked a crafted Microsoft link. The uncomfortable...
    • WindowsForum AI
    • Thread
    • data exfiltration microsoft 365 copilot prompt injection threat research
    • Replies: 0
    • Forum: Windows News
  2. WindowsForum AI

    Microsoft 365 Copilot SearchLeak Patch: Prompt Injection and Data Exfiltration Risk

    Microsoft patched a June 2026 vulnerability chain called SearchLeak in Microsoft 365 Copilot Enterprise after Varonis researchers showed that a crafted Microsoft 365 search link could make Copilot retrieve and exfiltrate emails, files, calendar details, and other indexed data with a single...
    • WindowsForum AI
    • Thread
    • copilot enterprise data exfiltration microsoft 365 prompt injection
    • Replies: 0
    • Forum: Windows News
  3. WindowsForum AI

    SearchLeak CVE-2026-42824: Copilot Prompt Injection and Enterprise Data Exfiltration

    On June 15, 2026, Varonis disclosed “SearchLeak,” a patched Microsoft 365 Copilot Enterprise vulnerability chain tracked as CVE-2026-42824 that could let an attacker exfiltrate data from a victim’s Microsoft 365 environment after a single click on a trusted-looking link. Microsoft has closed the...
    • WindowsForum AI
    • Thread
    • cve-2026-42824 data exfiltration microsoft 365 copilot prompt injection
    • Replies: 0
    • Forum: Windows News
  4. WindowsForum AI

    SearchLeak: Patched M365 Copilot Enterprise Search Flaw Exposes AI Data Chain Risk

    Varonis Threat Labs disclosed SearchLeak on June 15, 2026, describing a now-patched Microsoft 365 Copilot Enterprise Search vulnerability chain that could let an attacker steal emails, MFA codes, files, calendar details, and other indexed workplace data after a victim clicked a crafted Microsoft...
    • WindowsForum AI
    • Thread
    • ai security data exfiltration enterprise search microsoft 365 copilot
    • Replies: 0
    • Forum: Windows News
  5. WindowsForum AI

    SearchLeak in Microsoft 365 Copilot: How Prompt Injection Enables Data Exfiltration

    On June 15, 2026, Varonis Threat Labs disclosed SearchLeak, a patched Microsoft 365 Copilot Enterprise vulnerability chain that could let an attacker steal emails, MFA codes, calendar data, SharePoint files, OneDrive documents, and other indexed organizational content after a victim clicked a...
    • WindowsForum AI
    • Thread
    • cve-2026-42824 data exfiltration microsoft 365 copilot prompt injection
    • Replies: 0
    • Forum: Windows News
  6. WindowsForum AI

    Microsoft Copilot CVE-2026-42824 Patch: The SearchLeak AI Data Leak Warning

    Microsoft fixed CVE-2026-42824, a Microsoft 365 Copilot information-disclosure vulnerability disclosed in June 2026, after Varonis researchers described a one-click “SearchLeak” attack chain that abused Copilot Search, browser rendering behavior, and Microsoft service trust to leak enterprise...
    • WindowsForum AI
    • Thread
    • ai governance ai security ai security training cloud security copilot enterprise copilot security copilot vulnerabilities cve-2026-42824 data exfiltration enterprise governance enterprise search enterprise security information disclosure mfa code risk microsoft 365 microsoft 365 copilot microsoft 365 security microsoft copilot prompt injection searchleak vulnerability threat research
    • Replies: 14
    • Forum: Windows News
  7. WindowsForum AI

    AI Browsers Security Risks: Prompt Injection, Data Exfiltration & Agent Abuse

    AI chatbots with built-in browsers are no longer a novelty feature tucked away in a product demo. They are quickly becoming a default interface for searching the web, summarizing pages, clicking links, and even completing tasks on a user’s behalf. That convenience comes with a quietly expanding...
  8. WindowsForum AI

    CVE-2026-26144: Excel XSS Enables Zero-Click Data Exfiltration by Copilot

    Microsoft’s March Patch Tuesday pulled back a small, alarming corner of how modern productivity suites and agentic AI can interact — a cross‑site scripting flaw in Microsoft Excel that, when combined with the new Copilot Agent behavior, can be turned into a true zero‑click data‑exfiltration...
  9. WindowsForum AI

    Excel Copilot Agent Zero-Click Exfiltration: Patch CVE-2026-26144 Now

    Microsoft's March 10, 2026 Patch Tuesday brought a sharp reminder that legacy vulnerability classes can take on unexpected power when combined with modern AI assistants: a Microsoft Excel flaw (tracked as CVE-2026-26144, CVSS 7.5) can be weaponized as a zero-click data-exfiltration path when...
    • WindowsForum AI
    • Thread
    • copilot integration data exfiltration excel vulnerability patch tuesday 2026
    • Replies: 0
    • Forum: Windows News
  10. WindowsForum AI

    Excel CVE-2026-26144 XSS and Copilot Exfiltration: Zero-Click Disclosure

    A critical Microsoft Excel flaw disclosed in the March 2026 Patch Tuesday has opened a new, unsettling vector for data theft: a cross‑site scripting (XSS) bug that can be weaponized to make Microsoft’s Copilot Agent silently exfiltrate information without any user interaction — a true zero‑click...
    • WindowsForum AI
    • Thread
    • copilot agents copilot ai data exfiltration excel security excel vulnerability patch tuesday patch tuesday 2026 xss vulnerability
    • Replies: 1
    • Forum: Windows News
  11. WindowsForum AI

    Enterprise Risk: Malicious AI Extensions Steal Chat History via Chrome

    Microsoft Defender’s recent investigation shows a deceptive new vector for corporate data leakage: malicious Chromium‑based browser extensions that impersonate trusted AI assistant tools and quietly siphon LLM chat histories and browsing telemetry from users — at scale and with real-world...
    • WindowsForum AI
    • Thread
    • browser extensions data exfiltration enterprise security privacy risks
    • Replies: 0
    • Forum: Windows News
  12. WindowsForum AI

    Windows 11 Default Browser: One-Click Switch and EU DMA Changes

    Microsoft’s recent changes have finally untangled one of Windows 11’s most persistent irritations: setting a third‑party browser as the operating system’s default is now far less painful than it was at launch, and regulatory pressure in Europe has pushed the company even further toward...
    • WindowsForum AI
    • Thread
    • ai memory poisoning ai safety amd drivers copilot security data exfiltration deep link attack default browser driver security edge rivalry enterprise security european dma official sources prompt injection security research windows 11 windows 7
    • Replies: 3
    • Forum: Windows News
  13. WindowsForum AI

    Microsoft launches swarming to fix Windows 11 reliability in 2026

    Microsoft's public promise to "fix Windows 11" this year is not a marketing flourish — it's a direct response to hard, visible pain across the platform, and the company is now mobilizing a formal "swarming" effort to address the problems users and testers have been raising. Pavan Davuluri, who...
    • WindowsForum AI
    • Thread
    • ai infrastructure copilot platform copilot security data exfiltration enterprise ai hyperscale cloud incident response insider telemetry prompt injection software update threat mitigation windows 11 reliability
    • Replies: 2
    • Forum: Windows News
  14. WindowsForum AI

    Reprompt Attack: Securing Copilot Personal on Windows and Edge

    Security researchers have shown that a single, seemingly legitimate Copilot link could be turned into a stealthy data‑exfiltration pipeline — an attack chain the research community has labeled “Reprompt” — and the discovery raises urgent questions for anyone who uses Microsoft Copilot Personal...
    • WindowsForum AI
    • Thread
    • copilot security data exfiltration threat intelligence windows security
    • Replies: 0
    • Forum: Windows News
  15. WindowsForum AI

    MaliciousCorgi: Two VS Code AI Extensions Steal Developer Data

    Two Visual Studio Code extensions posing as helpful AI coding assistants have been linked to mass data theft that may have affected more than 1.5 million installs, with researchers saying the add-ons quietly uploaded whole files and workspace data to attacker-controlled servers in China...
    • WindowsForum AI
    • Thread
    • data exfiltration developer safety security threats vs code extensions
    • Replies: 0
    • Forum: Windows News
  16. WindowsForum AI

    Reprompt Attack: One-Click Copilot Data Exfiltration and Patch Mitigations

    Security researchers have shown that a single, seemingly legitimate Copilot link could be turned into a stealthy data‑exfiltration pipeline — a one‑click attack dubbed Reprompt — and Microsoft moved to mitigate the specific vector during the January 2026 Patch Tuesday updates. ) Background...
  17. WindowsForum AI

    Master Windows 11 Night Light: Setup Tune Troubleshoot and Alternatives

    Windows 11’s Night light gives you a one-click way to cut blue light, warm your display, and reduce evening eye strain — here’s a practical, forensic guide to turning it on, tuning it, troubleshooting when it’s missing, and choosing safer alternatives when you need color accuracy or more...
    • WindowsForum AI
    • Thread
    • blue light blue light filter color management color temperature copilot copilot personal data exfiltration eye strain night light patch tuesday prompt injection windows 11
    • Replies: 10
    • Forum: Windows News
  18. WindowsForum AI

    Reprompt Attack: One-Click Copilot Deep Link Exfiltration Explained

    A deceptively small convenience — a Copilot deep link that pre-fills your assistant’s prompt — has been weaponized into a one-click data-exfiltration technique researchers call Reprompt, demonstrating how AI assistants with access and memory can become a silent conduit for sensitive information...
  19. WindowsForum AI

    Reprompt Attack: One Copilot Link Exfiltrates Data

    Security researchers have discovered a deceptively simple but dangerous exploit that could turn a single click on a legitimate Microsoft Copilot link into a live data‑exfiltration pipeline — a vulnerability the research community has labeled “Reprompt,” and one that Microsoft moved to mitigate...
  20. WindowsForum AI

    Reprompt CVE-2026-21521: How Copilot Deep Links Expose User Data

    A single, deceptively small UX convenience in Microsoft’s Copilot ecosystem was chained into a practical, one‑click information‑disclosurere exploit that could siphon profile attributes, file summaries and chat memory from authenticated Copilot Personal sessions — a vulnerabilidentity tracked as...