Microsoft Copilot’s hidden prompt exposed in hack
▼ Summary
– Researchers at Varonis exploited Microsoft 365 Copilot Enterprise to exfiltrate user data via a malicious link, without any user confirmation beyond clicking.
– They discovered the vulnerability by asking Copilot itself about its guardrails, rather than using traditional reverse engineering methods.
– Copilot revealed an undocumented prompt parameter, `?autorun=1`, which, combined with `?q=`, silently executed prompts when a user clicked a crafted URL.
– Microsoft mitigated the issue in February by disabling `?q=` text injection, requiring manual typing, and introduced more comprehensive fixes on Tuesday.
– The exploit was notable for leveraging the AI’s own disclosures to bypass its consent mechanisms, demonstrating a novel attack vector.
It’s rare for attackers to force a frontier AI model to spill sensitive data like user passwords without explicit approval, but researchers recently pulled it off against Microsoft 365 Copilot Enterprise. What makes this case even stranger is how they uncovered the critical flaw: they simply asked Copilot itself. No reverse engineering, no traditional vulnerability hunting. The assistant happily obliged.
The team at security firm Varonis set out to build an exploit capable of exfiltrating user data with nothing more than a single click on a link. Like most modern AI assistants, Copilot initially refused such requests, insisting that sensitive actions require explicit user consent, typically through a gesture like pressing Enter or another key. Undeterred, the researchers shifted tactics and began interrogating Copilot about the guardrails that enforce those consent requirements.
The exchange unfolded like a game of 20 questions. Each refusal or answer leaked another fragment of the safety mechanism’s design. Why couldn’t auto-execution happen? What URL structures or deep links were involved? What occurred when a page loaded with text already sitting in the prompt field? With every response, the picture sharpened. Eventually, Copilot gave up a genuine Microsoft trade secret: an undocumented prompt parameter that completely sidestepped the need for user confirmation.
“At the beginning, Copilot kept refusing, but every refusal revealed technical details about its internal architecture,” said Lior Adar, Senior Researcher at Varonis, in an interview. “Copilot eventually disclosed undocumented parameters. I took those parameters and used them for prompts for running automatically.”
That parameter turned out to be the string `?autorun=1`. Combined with the well-known `?q=` parameter, the researchers’ prompt executed silently the instant a target clicked the malicious URL. Microsoft quietly patched the issue in February, three months after Varonis reported it, by disabling `?q=` from injecting text into the chatbot input. Users now had to click and type manually, a change that also broke third-party browser integrations relying on that parameter for legitimate purposes. On Tuesday, Microsoft rolled out more comprehensive fixes to close the gap further.
(Source: Ars Technica)
