Researchers tricked Microsoft Copilot into revealing the vulnerability that let them hack it

Varonis security researchers uncovered a critical flaw in Microsoft 365 Copilot Enterprise that could let attackers harvest passwords and sensitive user data with nothing more than a click. What made this discovery remarkable wasn't how they found it—it was who told them.

How they got Copilot to betray itself#

The researchers set out to build an exploit that would trigger data exfiltration the moment a user clicked a malicious link, without requiring any additional user action. They knew Copilot had safety guardrails designed to block such commands. So instead of trying to circumvent the protections through traditional reverse engineering, they simply asked the AI itself how the guardrails worked.

Working through a series of targeted questions—"Why is auto-execution impossible?" "What URL structures are involved?" "What happens when a page loads with pre-filled input?"—they gradually extracted technical details about the underlying architecture. With each answer, Varonis inched closer to the security mechanism's weak points.

"At the beginning, Copilot kept refusing, but every refusal revealed technical details about its internal architecture," said Lior Adar, a senior researcher at Varonis. "Copilot eventually disclosed undocumented parameters."

The secret parameter#

The breakthrough came when Copilot revealed the undocumented parameter: ?autorun=1. Combined with a known parameter called ?q=, which injects text into the chatbot input field, this one-line string became the skeleton key. A target user clicking on a malicious URL containing both parameters would trigger the attacker's prompt automatically—bypassing all consent requirements.

Response and remediation#

Varonis reported the vulnerability to Microsoft in November, but the company didn't fully address it for months. In February, Microsoft disabled the ?q= parameter from injecting text into Copilot's input, forcing users to manually click and type instead. This fix broke the attack chain but also disrupted legitimate third-party browser integrations that relied on the parameter.

On Tuesday, Microsoft rolled out more comprehensive security patches to address the root causes. The incident underscores a counterintuitive risk in AI security: sometimes the systems themselves are the most effective tools for discovering how to break them.