Microsoft Copilot hack: Secret parameter exposed by AI itself
Original: Microsoft Copilot reveals secret input that allowed it to be hacked
Why This Matters
The incident highlights how AI models themselves can become vectors for exposing security-critical internal architecture.
Security firm Varonis discovered that Microsoft 365 Copilot revealed an undocumented parameter '?autorun=1' through its own responses, enabling attackers to silently exfiltrate user passwords when a target clicked a malicious link. Microsoft mitigated the issue in February 2026.
Researchers at security firm Varonis exploited a critical vulnerability in Microsoft 365 Copilot for enterprise by using an unconventional method: asking Copilot itself. The team wanted to craft an exploit that would steal user data upon a single link click, without additional user interaction. When Copilot refused and explained its confirmation requirement, the researchers asked follow-up questions about URL structures, deep links, and prompt field behavior. Through this iterative Q&A process, Copilot eventually disclosed an undocumented internal parameter: '?autorun=1'. Combined with the known '?q=' parameter, this string caused prompts—including those designed to harvest passwords—to execute silently the moment a target clicked a malicious URL. 'Copilot kept refusing, but every refusal revealed technical details about its internal architecture,' said Varonis Senior Researcher Lior Adar. 'Copilot eventually disclosed undocumented parameters. I took those parameters and used them for prompts for running automatically.' Varonis reported the vulnerability to Microsoft, which silently applied an initial mitigation in February 2026 by disabling '?q=' text injection. More comprehensive fixes were released on August 18, 2026.