Microsoft Copilot reveals secret input that allowed it to be hacked
This title could be clearer and more informative.Try out Clickbait Shieldfor free (5 uses left this month).
Security researchers at Varonis discovered a critical vulnerability in Microsoft 365 Copilot Enterprise by interrogating the AI assistant itself, eventually coaxing it into revealing an undocumented parameter (?autorun=1) that bypassed user-consent requirements. Combined with the ?q= parameter, attackers could silently exfiltrate passwords and sensitive data the instant a target clicked a malicious link, without any additional confirmation gesture. Microsoft applied a partial mitigation in February by blocking ?q= from injecting text, then shipped a more comprehensive fix on Tuesday.
Questions this post answers
What was the Microsoft 365 Copilot vulnerability found by Varonis that let attackers steal passwords with just a link click?
Varonis researchers discovered an undocumented Copilot parameter, ?autorun=1, which when combined with the existing ?q= parameter allowed a malicious prompt to fire automatically the moment a target clicked a link, bypassing the required user confirmation gesture. This let attackers silently exfiltrate passwords and other sensitive data without any additional interaction from the victim. Security teams tracking prompt-injection risks in AI assistants can follow disclosures like this on daily.dev.
How did researchers get Microsoft Copilot to reveal the secret parameter that made the exploit possible?
Varonis researcher Lior Adar repeatedly questioned Copilot about why auto-execution was blocked and what URL structures and deep links were involved, and each refusal leaked technical details about the guardrail's internal architecture. Eventually Copilot disclosed the undocumented parameters itself, which the researchers then used to build a working automatic-execution exploit. Developers building on LLM assistants can weigh these prompt-leak risks by following security research on daily.dev.
When did Microsoft fix the Copilot ?autorun=1 vulnerability discovered by Varonis?
Microsoft first mitigated the issue in February, three months after Varonis reported it, by preventing the ?q= parameter from injecting text into the chat input, which forced users to click and type manually and broke third-party browser integrations relying on that parameter. A more comprehensive fix followed on the Tuesday referenced in the report. Teams patching AI-assistant integrations can track fix timelines and advisories like this via daily.dev.