Guard Your Stack: Conduct This 5-Point Audit After Copilot Raids Your Mailbox and LiteLLM Grants Admin Access

Recently, two artificial intelligence tools experienced similar vulnerabilities within a short timeframe, highlighted by the findings of four distinct research teams. At the core of each discovery lies a crucial issue: enterprise AI systems allow unverified external input without sufficient safeguards.

On June 15, Varonis revealed a vulnerability known as SearchLeak (CVE-2026-42824) in Microsoft 365 Copilot Enterprise Search, which can lead to unauthorized data extraction. The exploit occurs when an individual clicks on a malicious microsoft.com URL, prompting Copilot to search documents within their mailbox, resulting in data being exposed through a Bing server-side request forgery (SSRF). This process does not require any additional clicks or indications of the breach. Just days earlier, Obsidian Security reported a series of vulnerabilities affecting LiteLLM, enabling users with minimal privileges to elevate their access to administrator status and perform remote code execution. This was a clear demonstration of a compromised boundary within two separate tools.

The conclusion drawn from a detailed five-point audit conducted at the end of this article connects each identified weakness to its corresponding CVE or recent market indicator, providing actionable commands to enhance security before the end of the workday.

Copilot Transformed a Trusted URL into a Data Exfiltration Method

The SearchLeak vulnerability exploited three distinct weaknesses to create a covert data theft method. The URL’s query parameter provided instructions from an attacker directly to Copilot’s language model. In this case, a rendering race condition allowed an image tag to be initiated before the output sanitization could occur. Consequently, Bing’s image-search endpoint—previously allowed in the Content Security Policy—became the outlet for the stolen information. Microsoft has categorized this issue as critical and has implemented a back-end fix. However, the National Vulnerability Database has yet to assign a score, with external assessments rating it as medium severity at 6.5. While the debate over its severity continues, the breach mechanism itself remains uncontested.

The gravity of the escalation is noteworthy, marking the third instance of data exfiltration involving Copilot by Varonis in a single year, following the Reprompt and EchoLeak vulnerabilities. The Reprompt attack was directed at Copilot Personal, while SearchLeak affected Enterprise Search, which inherits comprehensive organizational privileges granted to the user, increasing the potential impact.

LiteLLM Granting Default Accounts Access to All Provider Keys

The LiteLLM gateway acts as a centralized proxy for various major AI services, including OpenAI and Azure. Obsidian’s three-step chain of vulnerabilities illustrates this, with CVE-2026-47101 allowing unauthorized users to generate wildcard API keys, CVE-2026-47102 promoting them to proxy administrators through an unprotected endpoint, and CVE-2026-40217 enabling sandbox escape with full privileges. Obsidian subsequently demonstrated remote shell access via a fabricated tool-call response within LiteLLM’s framework, assessing the severity of this combined vulnerability chain at CVSS 9.9 after a single word was entered by the developer.

A separate and urgent vulnerability within LiteLLM also emerged: CVE-2026-42271, a command injection issue discovered on June 8, which appeared on the CISA KEV list with a rapid remediation deadline set for June 22. This issue is separate from Obsidian’s disclosures, although both point to the same gateway, highlighting the vulnerability of LiteLLM, a tool celebrated with over 40,000 stars on GitHub, proving popular across numerous enterprise applications. This isn’t the first instance of concern surrounding LiteLLM, as earlier this year, compromised versions in March introduced backdoors.

Langflow and Mini Shai-Hulud Illustrate a Recurring Pattern

In addition to the aforementioned vulnerabilities, two additional tools experienced security breaches within the same period. The Langflow vulnerability, CVE-2026-5027, became the third RCE flaw attributed to Langflow this year, stemming from a path traversal issue in file uploads. Due to default auto-login settings, an attacker could exploit this with a single unauthenticated request. Confirmation of exploitation was observed on June 9, with approximately 7,000 exposed instances, predominantly in North America, acknowledged by MuddyWater.

The Mini Shai-Hulud campaign targeted a different aspect of system security. Following the public release of the worm’s source code on May 12, copycat versions affected 32 npm packages associated with Red Hat Cloud Services on June 1, with these packages garnishing around 80,000 downloads weekly. The worm is designed to collect over 20 types of credentials and can self-propagate under the guise of the compromised maintainer.

Four research teams have uncovered four different vulnerabilities, but they share the same systemic failure. The types of flaws vary, including prompt injection in SearchLeak, privilege escalation in LiteLLM, path traversal in Langflow, and supply-chain exploitation in Mini Shai-Hulud, yet all point to a fundamental security weakness.

The Market Has Already Adjusted Its Risk Perception

CrowdStrike’s recent earnings call provided insight into the financial implications of these vulnerabilities. Its AI detection and response service, AIDR, reported over a 250% sequential growth in annual recurring revenue (ARR) with a projected pipeline exceeding $50 million for the upcoming quarter. The total company ARR reached $5.51 billion, with telemetry indicating more than 1,800 autonomous applications actively running on enterprise endpoints.

On June 17, CrowdStrike expanded AIDR services to include AWS, integrating real-time evaluations of various AI communications channels. The company’s chief business officer emphasized that the AI attack surface now spans various layers, including development and cloud infrastructure; thus, treating them as separate areas could leave critical vulnerabilities exposed.

Insights from Practitioners on Identifying the Gap

David Levin, CISO at American Express Global Business Travel, noted that these vulnerabilities are unsurprising given the rise of “shadow AI,” likening it to the previous challenge of shadow IT. Tools such as Langflow and LiteLLM were adopted for convenience without proper governance, highlighting the need for foundational security measures prior to deployment.

Merritt Baer, former AWS Deputy CISO and current CSO at Enkrypt AI, pointed out that organizations often believe they’ve approved AI vendors when, in reality, they have only scrutinized the user interface and not the underlying systems that could become vulnerable under strain. She asserted that true risks reside in the integration points between models and data.

As Levin aptly put it, organizations must prioritize conversations on risk management inboard discussions rather than focusing solely on compliance. He stated, “It’s not about the size of the engineering team anymore. It’s the size of your imagination.” Both SearchLeak and LiteLLM exploited existing vulnerabilities without needing custom malware or zero-day attacks.

According to Adam Meyers, SVP of Intelligence at CrowdStrike, the critical challenges lie in patching these vulnerabilities and maintaining robust identity management, especially when AI systems possess their own identities or act on behalf of users.

The Trust-Boundary Audit: A Five-step Framework

The following five checks link specific vulnerabilities to proof points, providing actionable verification commands, necessary fixes, and essential summary statements for board reports.

The Solution Lies in Technical Adjustments Rather Than Policy Changes

The executive order issued on June 2 establishes an AI Cybersecurity Clearinghouse with a deadline for action by July 2. The five vulnerabilities outlined above are not indicative of cutting-edge problems but rather fundamental issues located within gateways, orchestration platforms, identity management systems, and runtime environments that shape the interaction between AI and enterprise applications.

Each row of the audit correlates with a disclosure or market indication from June, a command that can be executed pre-lunch, and an actionable statement for board discussions. The critical question is not whether your vendor will deploy patches; instead, it is whether you can identify the gaps proactively—before an attacker utilizes them as they did with Copilot and LiteLLM.