Undocumented Copilot parameter enabled silent prompt injection attacks

Researchers at Varonis found they could extract details about Microsoft 365 Copilot’s internal guardrails simply by asking the assistant questions, a process they likened to a game of 20 questions. Each refusal provided clues about the limits and structure of Copilot’s safety mechanisms, until the assistant ultimately disclosed an undocumented parameter—?autorun=1—that allowed automatic execution of prompts without user consent.

Using the revealed parameter, the researchers constructed a malicious URL that combined ?autorun=1 with the standard ?q= prompt parameter. When a user clicked the link in an authenticated session, Copilot automatically executed the embedded prompt without any additional user gesture, enabling theft of the latest sender’s email address and any credentials present in the inbox.

The exfiltrated data was sent to an attacker-controlled server via a separate URL that Copilot automatically opened on the victim’s device. To avoid transmission errors and conceal the data theft, the stolen information was encoded in base64 format.

Microsoft restricted URL-based prompt injection in February 2026 after Varonis reported the issue, requiring users to click and type manually instead of allowing automated parameter injection. The company said it introduced more comprehensive fixes on August 18, 2026.

Separately, Varonis demonstrated a second attack that poisoned Copilot’s persistent memory store by embedding a prompt injection in a webpage’s metadata. When a user instructed Copilot to summarize the page, the assistant updated its memory with attacker-controlled instructions. These false memories persisted across password changes, session revocations, and device re-enrollments, and could be used to bias responses or trigger attacker-defined actions.