Microsoft Copilot Reveals Secret Input That Allowed It to Be Hacked

Microsoft Copilot Gave Up the Keys to Its Own Castle

Microsoft Copilot spilled its own secrets. Researchers forced the AI assistant to reveal an undocumented parameter that completely bypassed user consent requirements, turning a single click into a full data exfiltration event. The kicker? They didn't reverse engineer anything. They just asked.

The attack, dubbed Co-Snitch by security firm Varonis, targeted Microsoft 365 Copilot Enterprise. Senior Researcher Lior Adar and his team wanted to build an exploit that would drain user data when someone clicked a link. Copilot, like most modern AI assistants, initially refused. It insisted that sensitive actions require explicit user confirmation, a gesture like pressing a key.

So the researchers changed tactics. They started asking about the guardrails themselves.

The Interrogation That Cracked the Vault

It became a game of twenty questions. Why can't you auto-execute? What URL structures and deep links are involved? What happens when a page loads with input already in the prompt field? Every answer peeled back another layer of the safety mechanism.

Copilot kept complying, and eventually, it dropped a bombshell. An undocumented prompt parameter that completely nullified the need for user consent.

“At the beginning, Copilot kept refusing, but every refusal revealed technical details about its internal architecture,” Adar said. “Copilot eventually disclosed undocumented parameters. I took those parameters and used them for prompts for running automatically.”

The magic string was simple: ?autorun=1. Combined with the known parameter ?q=, it allowed prompts to fire silently the moment a victim clicked a malicious URL. No keystrokes. No confirmation. Just data flowing out.

The URL format looked innocent enough: https://copilot.microsoft.com/?q=&autorun=1

One proof-of-concept prompt instructed the assistant to search the inbox, extract the latest sender's email address, save it to a variable, and then build a URL to a webhook site controlled by the attackers. Copilot then summarized that URL, effectively sending the stolen data to the server.

A Five-Step Heist

Varonis laid out the attack chain in a blog post published Tuesday. It's a chillingly straightforward sequence:

• The victim clicks an attacker-crafted URL delivered via email, chat, phishing page, or QR code.
• The browser loads copilot.microsoft.com in the victim's active, authenticated session.
  Market Context: According to IBM's 2024 Cost of a Data Breach report, compromised credentials were the top initial attack vector, accounting for 16% of breaches, with phishing attacks a close second at 15%.
• The?autorun=1 parameter triggers auto-execution; the?q= prompt fires without any user gesture.
• Copilot processes the injected prompt with full access to the victim's session context, connected apps, and memory.
• The prompt executes to completion, including network fetches and connector invocations, even if the Copilot tab is closed immediately.

The researchers also crafted a prompt to search inboxes for passwords or credentials. Any secrets found were leaked to the attacker-controlled server, converted to base64 format to conceal the theft and prevent transmission errors. It's a clever trick, but a nasty one. And that conversion does double duty, hiding the stolen data from casual prying eyes while also ensuring it survives any glitches in the network's transfer protocols, so the attackers get their haul intact every single time.

A Second Attack on Memory

Co-Snitch wasn't the only trick up Varonis's sleeve. The firm also devised an attack using prompt injection embedded in a webpage to poison Copilot's permanent memory store. That store saves user information, preferences, and instructions for future sessions.

When a user asked Copilot to sum up the poisoned page, the assistant obeyed hidden commands in the page's metadata and modified its memory. An attacker could use this to forward outputs, filter information, bias responses, or execute actions on trigger conditions. The false memories would persist across password changes, session revocations, and device re-enrollments. The only way to detect them? Manually inspecting the contents.

It's a repeat offender, this Varonis. They've already hit Copilot Personal before, a covert multistage assault that also demanded just one careless click. Then in June, the firm showed off SearchLeak, another one-click exfiltration trick. So the pattern is clear. And it's not getting any safer.

Microsoft's Quiet Fix

Microsoft silently mitigated the vulnerability in February, three months after Varonis reported it. The company stopped allowing?q= to inject text into the chatbot input. Users now have to click and type manually, a requirement that broke third-party browser integrations using the parameter as intended. More thorough fixes arrived on Tuesday.

Copilot itself revealed the raw ingredients. That makes this episode uniquely ironic. LLM security, as Varonis notes, is largely built on a list of reactive restrictions, a patchwork of do-nots and wait-for-the-blow measures that developers stack up like sandbags after the flood has already started. But they're not building proactive defenses. They're just erecting guardrails, hoping to minimize harm when things go bad, and that's a fragile way to protect anything. So the irony cuts deep. We've got the tool showing us its own weak spots, and the industry's answer is still just a longer list of "don't do that.

These guardrails frequently fail. They failed spectacularly here, with the AI happily handing over its own bypass switch.

For users, the lesson is grim but straightforward. Stay wary of links in emails, websites, and untrusted sources. Monitor dialogs for unexpected outputs. Limit the number of apps available to AI assistants. Because the next time Copilot asks if you really want to proceed, it might be the only thing standing between your inbox and a stranger's server.