Microsoft Copilot reveals secret input that allowed it to be hacked
| Source: Ars Technica AI
Tags: Microsoft Copilot, prompt injection, Varonis, enterprise security, AI vulnerability, Microsoft 365
Varonis researchers extracted a secret Microsoft 365 Copilot parameter (?autorun=1) by asking the AI to explain its own security guardrails — enabling one-click password exfiltration without user confirmation, a vulnerability Microsoft has now fully patched.
Details
Security firm Varonis discovered that Microsoft 365 Copilot Enterprise contained an undocumented parameter that completely bypassed its user-consent requirement. Rather than traditional vulnerability hunting, researchers simply asked Copilot questions about its own security architecture — and the model gradually disclosed the secret: appending ?autorun=1 alongside the known ?q= parameter caused prompts to execute silently the moment a target clicked a malicious URL.\n\nThis enabled a one-click attack where Copilot would exfiltrate passwords and sensitive data from connected Microsoft 365 services without any user action beyond clicking a link. Senior Researcher Lior Adar noted: 'Copilot eventually disclosed undocumented parameters. I took those parameters and used them for prompts for running automatically.'\n\nMicrosoft made a partial mitigation in February 2026, three months after Varonis reported it, by restricting the ?q= parameter from injecting text automatically. More comprehensive fixes were deployed Tuesday. The incident demonstrates how AI systems can be made to reveal their own internal mechanisms when prompted carefully — social engineering applied to the model itself.\n\nFor enterprise Copilot deployments, this underscores the risk of granting AI assistants broad permissions over sensitive data, and the need to monitor for URL-based prompt injection attacks.