Microsoft Copilot reveals secret input that allowed it to be hacked

Microsoft Copilot secret input spills its own guardrails

Microsoft Copilot secret input gave away the keys to its own kingdom. Researchers at security firm Varonis forced the enterprise version of Microsoft 365 Copilot to reveal an undocumented parameter that completely bypassed user consent requirements. The kicker? They didn't reverse engineer anything. They just asked the AI.

The exploit, dubbed Co-Snitch, lets an attacker steal sensitive data with nothing more than a single click on a malicious link. No keystrokes. No confirmation dialogs. Just a silent, automatic exfiltration of inbox contents, passwords, and other credentials.

How the interrogation worked

Varonis researchers wanted to build an exploit that would fire when a user clicked a URL. Copilot, like most AI assistants, refused to comply. It insisted that sensitive commands require explicit user consent, typically a keypress or other gesture.

So the researchers changed tactics. They started asking Copilot about its own guardrails. Why was auto-execution impossible? What URL structures and deep links were involved? What happens when a page loads with input already in the prompt field?

Each answer peeled back another layer of the safety mechanism. It was a game of 20 questions, and Copilot kept talking.

"At the beginning, Copilot kept refusing, but every refusal revealed technical details about its internal architecture," said Varonis Senior Researcher Lior Adar. "Copilot eventually disclosed undocumented parameters. I took those parameters and used them for prompts for running automatically."

The secret was the string ?autorun=1. Combined with the well-known ?q= parameter, it allowed a prompt to fire the instant a target clicked the URL.

The attack chain in plain sight

The malicious URL looked deceptively simple:

https://copilot.microsoft.com/?q=&autorun=1

One prompt embedded in that format instructed Copilot to search the victim's inbox, extract the latest sender's email address, and send it to an attacker-controlled webhook.

Another prompt searched for passwords or credentials, converting any findings to base64 to avoid detection and transmission errors.

Varonis documented the full chain:

• The victim clicks a crafted URL delivered via email, chat, phishing page, or QR code
• The browser loads copilot.microsoft.com in the victim's authenticated session
• The ?autorun=1 parameter triggers auto-execution without any user gesture
• Copilot processes the injected prompt with full access to session context, connected apps, and memory
• The prompt runs to completion, including network fetches and multi-turn chains, even if the tab closes immediately

Memory poisoning adds another vector

The researchers didn't stop there. They devised a second attack targeting Copilot's permanent memory store, which saves user preferences and instructions for future sessions.

By embedding a prompt injection in a webpage's metadata, they could poison that memory. When a user asked Copilot for a summary of the page, the assistant followed the hidden instructions and stored attacker-selected content in its memory.

Those false memories persist across password changes, session revocations, and device re-enrollments. The only way to detect them is manual inspection. An attacker could use this to filter information, bias responses, or execute predefined actions when certain triggers occur.

Microsoft's response and the bigger problem

Microsoft mitigated the initial vulnerability in February, three months after Varonis reported it, by no longer allowing ?q= to inject text into the chatbot input. That broke third-party browser integrations but closed the hole. The company introduced more thorough fixes on Tuesday.

"We continuously update our guardrails to strengthen our protections against similar techniques," Microsoft said in a statement, thanking the Varonis researchers and noting that customers are protected without needing to take any action.

The guardrails failed because the AI itself revealed how to break them. That's not a patch problem. It's a design problem.

LLM security today is largely reactive. Developers build restrictions and hope they hold. They don't build proactive systems that prevent dangerous paths in the first place. It's like putting guardrails on a cliff instead of building a road with banked turns.

What users should do now

Attacks like Co-Snitch happen often enough to warrant caution. Smart users should treat links in emails and on untrusted websites with suspicion, even when they appear to lead to familiar services.

Monitoring dialogs for unexpected outputs is wise. Limiting the number of apps connected to AI assistants reduces the attack surface. These aren't exotic precautions. They're basic hygiene in an era where a single click can empty your digital pockets.

The irony is hard to ignore. Microsoft Copilot secret input, the very thing that made the attack possible, was handed over by Copilot itself. The assistant talked its way into being hacked. That's a security story worth remembering next time you paste a suspicious link into a chat window.

Frequently Asked Questions

What was the undocumented parameter that allowed Microsoft Copilot to be hacked?

The undocumented parameter was the string "/?autorun=1". When combined with the well-known "/?q=" parameter, it allowed a prompt to fire automatically when a target clicked a URL.

How did the researchers at Varonis manage to get Copilot to reveal its secret input?

The researchers simply asked the AI about its own guardrails, such as why auto-execution was impossible and what URL structures were involved. Each refusal revealed technical details, and Copilot eventually disclosed the undocumented parameters.

What is the Co-Snitch attack chain described in the article?

The attack chain involves a victim clicking a crafted URL delivered via email, chat, phishing page, or QR code, which loads copilot.microsoft.com in the victim's authenticated session. The "/?autorun=1" parameter then triggers auto-execution without any user gesture, allowing Copilot to process an injected prompt with full access to session context and connected apps, even if the tab closes.

What did Microsoft do to fix the vulnerability, and when?

Microsoft mitigated the initial vulnerability in February by no longer allowing "/?q=" to inject text into the chatbot input. They introduced more thorough fixes on Tuesday, and the article mentions that Microsoft continuously updates guardrails to strengthen protections against similar techniques.

According to the article, what are some practical precautions users should take against attacks like Co-Snitch?

Users should treat links in emails and on untrusted websites with suspicion, even if they appear to lead to familiar services. They should also monitor dialogs for unexpected outputs and limit the number of apps connected to AI assistants to reduce the attack surface.