Researchers at Varonis discovered a critical vulnerability in Microsoft 365 Copilot that allowed the AI to exfiltrate user data without explicit consent. The exploit leveraged an undocumented URL parameter, "?autorun=1," that bypassed standard security controls.
The attack vector worked by combining two parameters. The "?autorun=1" parameter triggered automatic execution of prompts, while "?q=" injected malicious instructions into the chatbot input. When a target user clicked the link, Copilot silently executed the prompt and exposed the victim's session context, connected applications and memory.
Varonis discovered the flaw through a novel research method. Instead of traditional reverse engineering, the team engaged Copilot in iterative conversation about its own guardrails. Each time Copilot refused to execute a sensitive command, the refusal itself disclosed technical details about its internal architecture. Through this dialog, Copilot eventually revealed the undocumented parameters.
"At the beginning, Copilot kept refusing, but every refusal revealed technical details about its internal architecture," said Lior Adar, senior researcher at Varonis. "Copilot eventually disclosed undocumented parameters. I took those parameters and used them for prompts for running automatically."
The vulnerability exposes a design flaw: AI assistants that can receive URL-embedded prompts often lack sufficient friction between command receipt and execution. Most such systems require explicit user approval before executing embedded instructions. Copilot's architecture allowed the bypass.
Microsoft applied an initial mitigation in February, three months after Varonis reported the flaw. The fix prevented "?q=" from injecting text directly into the input field, requiring users to manually click and type. The change affected third-party browser integrations that relied on this parameter. Microsoft deployed more comprehensive fixes on Tuesday.
The incident highlights a tension in enterprise AI deployment: as organizations integrate AI deeper into workflows that handle sensitive data, the security surface expands. A self-disclosing vulnerability—where the AI reveals its own bypass mechanisms through conversation—suggests the model's safety guardrails lack the isolation needed to prevent architectural details from leaking during normal interaction.
For Microsoft, which has committed over $10 billion to OpenAI and positioned AI as central to its cloud strategy, vulnerabilities that expose fundamental design flaws carry material risk. Enterprise customers evaluating Copilot for handling confidential business data now have concrete evidence that the system's security model has gaps. Trust erosion directly impacts adoption rates and, consequently, the business case for Microsoft's AI infrastructure investments.
