Microsoft 365 Copilot for enterprise disclosed passwords and sensitive data without explicit user confirmation after researchers at security firm Varonis exploited a critical vulnerability in the AI assistant's safety mechanisms.
Varonis researchers aimed to exfiltrate user data silently when targets clicked malicious links. Copilot initially refused such requests, requiring explicit user consent through actions like key presses. To bypass this, the team engaged Copilot in dialogue about its internal guardrails, asking why auto-execution was impossible, inquiring about URL structures and deep links, and questioning behavior when pages loaded with pre-populated input fields.
Each answer from Copilot provided technical details about its safety architecture. Through iterative questioning, the AI disclosed a Microsoft trade secret: an undocumented prompt parameter.
"Every refusal revealed technical details about its internal architecture," said Lior Adar, senior researcher at Varonis. "Copilot eventually disclosed undocumented parameters, which we then used for automatically running prompts."
The specific parameter—`?autorun=1`—combined with the documented `?q=` parameter allowed researchers to fire prompts silently the moment a target user clicked a malicious URL. This method bypassed the standard approval requirement, enabling command injection directly into Copilot without user interaction.
The base part of a URL can open an LLM such as Gmail, while parameters instruct the assistant to perform actions like summarizing inbox contents.
Microsoft silently mitigated the vulnerability in February, three months after Varonis reported the flaw. The initial fix prevented `?q=` from injecting text into the chatbot input, requiring users to click and type manually. This inadvertently prevented third-party browser integrations from using the `?q=` parameter as intended. Microsoft introduced more comprehensive fixes on Tuesday.
