Copilot searched your mailbox. LiteLLM handed out admin keys. Run this 5-check audit before your stack is next

In a span of two weeks, two AI tools failed due to the same vulnerability, as demonstrated by four research teams. The overarching issue in these incidents is a lack of trust boundaries for external input in enterprise AI systems.

On June 15, Varonis revealed SearchLeak (CVE-2026-42824), a proof-of-concept exploit targeting Microsoft 365 Copilot Enterprise Search. The exploit involves a user clicking a specially crafted microsoft.com URL, prompting Copilot to search their mailbox and exfiltrate the data via a Bing SSRF. This process requires no additional plugins, clicks, or visible indicators. Earlier, on June 11, Obsidian Security disclosed a three-CVE chain against LiteLLM, which allowed a low-privilege user to escalate to admin status and execute remote code. Both incidents highlight a single vulnerability across different tools.

The concluding five-check audit in this article aligns each gap with a CVE or a market signal from June, providing actionable steps and a summary a CISO can present to the board.

Copilot Exploitation via Trusted URL

SearchLeak combines three vulnerabilities to execute data theft quietly. The q parameter in a URL directs instructions to Copilot’s language model. A race condition allows an image tag to be rendered before the output is sanitized. Bing’s image-search endpoint, included in the Content Security Policy, facilitates data extraction. Microsoft classified this vulnerability as critical and has patched it on the back end, as per Varonis. Although NVD has yet to score it, a third-party tracker rates it as a medium severity of 6.5. The severity is debated, but the flaw mechanism is clear.

The escalation is noteworthy. This marks the third Varonis Copilot exfiltration chain within a year, following Reprompt in January and EchoLeak in 2025. While Reprompt affected Copilot Personal, SearchLeak targets Enterprise Search, affecting the user’s entire organizational permissions scope.

LiteLLM’s Vulnerable Gateway

The LiteLLM gateway secures keys for OpenAI, Anthropic, Azure, and Bedrock under one proxy. The Obsidian exploit unfolds in three steps: CVE-2026-47101 allows a non-admin user to generate a wildcard API key; CVE-2026-47102 escalates the user to proxy admin through an unprotected /user/update endpoint; and CVE-2026-40217 breaks out of the code sandbox using exec() with full builtins. Obsidian showcased a reverse shell by injecting a fake tool-call response via LiteLLM’s callback mechanism, rating the combined chain at CVSS 9.9. A single word typed by a developer enabled the attacker to execute a shell.

An additional LiteLLM issue, CVE-2026-42271, a command-injection flaw in MCP test endpoints, was added to the CISA KEV list on June 8, with a remediation deadline of June 22. This CVE is separate from the Obsidian chain. Both disclosures occurred four days apart and were resolved through different updates targeting the same gateway. LiteLLM, with over 40,000 GitHub stars, is widely deployed across enterprises. A prior supply-chain compromise affected LiteLLM versions 1.82.7 and 1.82.8 on PyPI in March, where a compromised gateway risks exposing all provider credentials.

Langflow and Mini Shai-Hulud: Evidence of Scaling Vulnerabilities

In the same period, two additional tools exhibited similar boundary failures. Langflow CVE-2026-5027 is the third remote-code-execution flaw for Langflow to be actively exploited this year. A path traversal vulnerability in file upload allows attackers to write files anywhere on disk, and with auto-login enabled by default, a single unauthenticated request leads to RCE. VulnCheck confirmed this exploitation on June 9, noting approximately 7,000 exposed instances, primarily in North America, with MuddyWater attribution.

The Mini Shai-Hulud campaign exploited a different aspect. Following the public release of the worm’s source code on May 12, copycats compromised 32 Red Hat Cloud Services npm packages on June 1, which are downloaded 80,000 times weekly. The worm gathers over 20 credential types and self-replicates using the compromised maintainer’s identity.

Four teams evaluated four tools, identifying a shared operational failure. While the bug classes varied—prompt injection for SearchLeak, privilege escalation for LiteLLM, path traversal for Langflow, and supply-chain poisoning for Mini Shai-Hulud—the underlying issue remained consistent across all.

Reevaluating Risk in the Market

CrowdStrike’s Q1 FY27 earnings call quantified this risk gap. Their AI detection and response line, AIDR, saw more than 250% sequential growth in ARR, with a Q2 pipeline exceeding $50 million (SEC-filed 8-K). CrowdStrike’s total ARR reached $5.51 billion, highlighting over 1,800 agentic applications operating across enterprise endpoints.

On June 17, the company expanded AIDR to AWS, incorporating real-time evaluations of agent, LLM, and MCP communications across Amazon Bedrock, Kiro, and Strands Agents, leveraging their collaboration with Anthropic’s Project Glasswing. Daniel Bernard, CrowdStrike’s chief business officer, emphasized that the AI attack surface now includes development, runtime, identities, and cloud infrastructure, noting that treating these as separate domains leaves vulnerabilities unaddressed.

Industry Professionals Highlight the Same Gaps More Simply

David Levin, CISO at American Express Global Business Travel, expressed no surprise to VentureBeat, stating, “We kind of have this shadow AI, which is just the new version of shadow IT.” Both Langflow and LiteLLM fit this pattern, as teams implemented them for convenience, granted them credentials, and neglected governance. Levin stresses the importance of foundational work before deployment. “We didn’t go into this with just saying we’re going to go do this without the right fundamentals,” he noted. “We leverage NIST controls. NIST has released their CSF along with their AI framework. OWASP released their top 10. You need the right fundamentals before you deploy.”

Merritt Baer, CSO at Enkrypt AI, identified the structural failure in a separate interview, stating, “Enterprises believe they’ve ‘approved’ AI vendors, but what they’ve actually approved is an interface, not the underlying system.” Baer highlights that deeper dependencies are prone to failure under stress, adding, “Raw zero-days aren’t how most systems get compromised. Composability is. It’s the glue between the model and your data where the risk lives. If you give an agent bash and a root token, you’ve already done most of the attacker’s work for them.” This is reflected in the audit tests focusing on gateway security and agent identity governance.

Levin further advised boardrooms to prioritize risk over compliance. “You need to talk more in terms of risk versus compliance to your boards and your executives,” he said. “It’s not about the size of the engineering team anymore. It’s the size of your imagination. It’s all written in plain English. It’s not hard for anyone.” Notably, neither SearchLeak nor LiteLLM required custom malware or zero-days for exploitation.

Adam Meyers, CrowdStrike’s SVP of Intelligence, emphasized the challenge in an exclusive interview, stating, “The problem is not zero-day. The problem is patching. If you 10x that problem, they’re gonna be completely underwater.” He identified identity as another critical area, noting, “Some of these AI have their own identities, or people give their identity to the AI to take action on their behalf, and that makes it a very complex problem.”

The Five-Check Trust-Boundary Audit

The following table outlines each trust-boundary gap, its proof point, the breakdown, verification and fix steps, and language suitable for board reporting.

Addressing Infrastructure, Not Just Policies

A June 2 executive order established an AI Cybersecurity Clearinghouse with a July 2 deadline. The five gaps identified are not issues of advanced AI models but rather infrastructure challenges within gateways, orchestration platforms, identity layers, and runtime environments in enterprises.

The audit comprises five rows, each aligned with a June disclosure or market signal, an actionable command, and a summary for board discussions. The crucial question is whether your team can identify and address these gaps before an attacker does, as seen with Copilot and LiteLLM.