Critical Copilot vulnerability allowed hackers to steal 2FA code from users

A now-patched vulnerability in Microsoft Copilot, dubbed SearchLeak, allowed attackers to exfiltrate two-factor authentication codes from users through a prompt injection attack embedded in search results. The exploit is a textbook illustration of how LLM integrations can silently extend an attacker's reach into sensitive user data in ways traditional security models were not designed to anticipate. Security researchers note that the incident reflects a systemic failure in how the industry approaches LLM threat surfaces rather than an isolated implementation error.