Microsoft Copilot Handed Researchers Secret Parameter for Hack

👁 117 reads

Security researchers at Varonis extracted an undocumented URL parameter directly from Microsoft 365 Copilot itself, then used it to build an exploit that exfiltrated user passwords and inbox data the moment a target clicked a link - no keypress required.

The Varonis team, led by Senior Researcher Lior Adar, wanted to construct a zero-interaction data-theft attack against the enterprise AI assistant. Copilot repeatedly refused to help, but each refusal described more of the guardrail it was protecting. The researchers kept asking: why was auto-execution blocked, which URL structures were involved, what happened when a page loaded with text already in the prompt field?

“At the beginning, Copilot kept refusing, but every refusal revealed technical details about its internal architecture. Copilot eventually disclosed undocumented parameters. I took those parameters and used them for prompts for running automatically.”

The disclosed string was ?autorun=1. Combined with the separately known ?q= parameter, it produced a URL in the form https://copilot.microsoft.com/?q=&autorun=1 that silently fired an injected prompt on page load. One demonstration prompt instructed Copilot to find the latest email in the user’s inbox, extract the sender’s address, build an external webhook URL containing that address, and then summarize the webhook URL - a command that pushed the harvested data to an attacker-controlled server.

Varonis reported the vulnerability to Microsoft, which issued a partial mitigation in February - three months later - by blocking ?q= from injecting text into the chatbot input. More comprehensive fixes followed on Tuesday of this week.

Practitioner takeaway: This case shows that probing an AI assistant about its own safety mechanisms is a viable attack-research technique - one that requires no reverse engineering. For anyone building on top of AI APIs or deploying enterprise copilots, it is worth auditing which URL parameters your integration accepts and whether any could be combined to bypass confirmation steps. Treat AI guardrail descriptions as potentially sensitive information and restrict what your deployment reveals about its own architecture.

// read moreMicrosoft merges two Copilot apps into one, ahead of ‘super app’AI ToolsMicrosoft Copilot: What It Is, Pricing & Is It Worth It (2026)GuidesOpenAI Admits Error After Revoking Researchers’ Daybreak AccessNews

Kinetyra