Microsoft Copilot 2FA vulnerability and Meta’s Instagram exploit: what AI builders should know about prompt-driven data exposure

A critical vulnerability in Microsoft Copilot Enterprise allowed attackers to steal 2FA codes, emails, and calendar data with a single click, while a separate Meta AI chatbot exploit let hackers take over Instagram accounts by simply asking. For AI builders, these incidents highlight how enterprise copilots inherit user permissions and how prompt injection techniques can turn trusted URLs into data exfiltration paths.

What happened

Researchers at Varonis Threat Labs discovered a vulnerability chain in Microsoft 365 Copilot Enterprise Search that they named SearchLeak. The exploit used a parameter-to-prompt (P2P) injection embedded in a Bing URL, which is whitelisted because it is Microsoft's own domain. When a victim clicked the crafted link, Copilot executed the malicious prompt without any further user input, exfiltrating data from the user's emails, calendar, and indexed files. Microsoft rated the vulnerability as max severity critical and has since patched it.

Because Copilot Enterprise operates with the user's full graph permissions, the attacker effectively inherits the victim's access to the organization's data without ever authenticating. The blast radius includes emails, meeting invites, notes, and any other content the user can access within Microsoft 365, and could extend further depending on how M365 is connected to the environment.

Just two weeks earlier, Meta's AI chatbot support assistant was exploited by hackers who, after switching on a VPN, simply asked the bot to change the email address on a target Instagram profile. This allowed them to bypass two-factor authentication and take over the account.

Why AI builders should care

These incidents demonstrate a fundamental risk for any AI product that integrates with enterprise data: the AI inherits the user's full permission set. In the Copilot case, no additional authentication was required for the attacker to access sensitive data once the user clicked the link. This is a design pattern that many AI builders replicate when connecting LLMs to internal APIs, databases, or file stores.

The SearchLeak exploit also introduces a novel attack surface: parameter-to-prompt injection. Unlike traditional prompt injection where the malicious text is in the user's input, P2P injection places the attack in the query parameters of a URL. This means that even if you sanitize user prompts, an attacker can still manipulate the system through trusted URLs that the AI processes automatically.

Practical implications

For teams building AI copilots or agentic workflows, the immediate takeaway is to review how permissions are scoped. Copilot Enterprise should be configured with least-privilege access, limiting what data the AI can retrieve on behalf of each user. The same principle applies to any AI tool that connects to internal systems.

Developers should also validate how URLs and query parameters are handled by their AI integrations. If your system processes URLs from trusted domains, an attacker could embed malicious instructions in those parameters. Implementing strict input validation and output monitoring for prompt injection patterns is essential.

Security teams should monitor for unusual data access patterns from AI services, especially when users click links that trigger automated searches or data retrieval. The SearchLeak attack required no typing from the victim, so traditional user behavior monitoring may not catch it.

Caveats

The findings come from security researchers at Varonis and have been reported by multiple outlets, but no official Microsoft confirmation beyond the patch has been included in the cited coverage. Technical details of the exploit may vary across different M365 environments and Copilot configurations. The vulnerability was patched, but the underlying design pattern of permission inheritance remains relevant for all AI builders.