Product
Copilot Search
- First Reported
- Jun 17, 2026
- Latest Reported
- Jun 17, 2026
Reported Context (1)
- The chain abused Copilot Search’s q parameter as an instruction prompt, raced Microsoft’s HTML sanitizer during streaming, then used Bing’s image search endpoint as an SSRF-powered exfil proxy. Microsoft remediated the Weekly Security Roundup: Copilot SearchLeak, AI Security Deals and Surveillance Misuse
CVE (1)
Vendors (2)
Products (2)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.