Microsoft Copilot reveals secret input that allowed it to be hacked

Researchers at security firm Varonis discovered a vulnerability in Microsoft 365 Copilot Enterprise by questioning Copilot about the guardrails designed to prevent commands from running without user confirmation. Rather than reverse-engineering the system, they used the assistant’s own answers to uncover an undocumented parameter: `?autorun=1`. Combined with the known `?q=` parameter, it allowed prompts to execute when a target clicked a crafted URL, without pressing a key or otherwise providing consent. The format was `https://copilot.microsoft.com/?q=&autorun=1`. One proof of concept instructed Copilot to search the victim’s inbox, extract the latest sender’s email address, store it in a variable named SUPPORT, and send it to an attacker-controlled webhook.site address. A separate prompt searched for passwords and other credentials. Copilot could append the information to a URL it automatically opened, while converting the data to base64 to conceal the theft and reduce transmission errors. The attack required only one click on a link delivered through email, chat, a phishing page or a QR code. Copilot operated within the victim’s authenticated session and could access connected applications and memory. Network fetches, connector invocations and multi-turn chains could continue even if the Copilot tab was closed immediately after loading. Microsoft silently mitigated the vulnerability in February, three months after Varonis reported it, by preventing `?q=` from injecting text into the chatbot input. Microsoft introduced broader fixes on Tuesday. Varonis separately demonstrated a prompt-injection attack that poisoned Copilot’s permanent memory, which stores user information, preferences and instructions. Hidden webpage metadata could cause Copilot to save attacker-defined instructions that persisted through password changes, session revocations and device re-enrollments. The false memories could forward outputs, filter information, bias responses or trigger actions; detecting them required manual inspection. Varonis named the attacks Co-Snitch. The firm previously demonstrated a one-click attack against Copilot Personal and, in June, another exfiltration attack called SearchLeak. The episode highlights security and governance risks for organizations adopting AI assistants. Users should distrust unverified links, monitor unusual outputs and limit connected applications. It also illustrates how reactive LLM guardrails can fail.