Microsoft has patched a vulnerability in Copilot that allowed attackers to obtain sensitive information, including data from a user’s email inbox, with a single click. Remarkably, researchers obtained some of the necessary technical information directly from Copilot itself.
Researchers at security firm Varonis discovered that Microsoft 365 Copilot could execute commands embedded in a specially crafted URL, according to Ars Technica. Normally, the AI assistant requires user interaction, such as a click or keystroke, to execute such commands. This is intended to prevent an external party from executing commands unnoticed within an active Copilot session.
Varonis attempted to bypass this control by repeatedly asking Copilot questions about its own security mechanisms. The answers revealed increasingly detailed information about URL structures, deep links, and how pre-filled prompts are processed.
Eventually, Copilot mentioned an undocumented parameter: ?autorun=1. Combined with the existing parameter ?q=, this allowed a command to start automatically as soon as someone opened a manipulated link.
Access via an existing session
After clicking the link, Copilot opened within the user’s already logged-in session. The provided prompt could then be processed automatically, using the permissions and links Copilot had within that session.
For example, Varonis demonstrated that the assistant could search the mailbox and send the data it found to an external server. It was also possible to perform targeted searches for passwords or other login credentials in emails.
To do this, the researchers used a URL to which the found information was appended. Copilot then automatically opened it, sending the data to a server controlled by the researchers. The information was converted to base64 in the process.
The vulnerability was assigned the number CVE-2026-24301. Varonis reported the issue to Microsoft in November. The company took initial measures in February by preventing “?q=” from directly inserting text into the input field. More extensive fixes followed this week. According to Microsoft, users do not need to take any action themselves.
Memory manipulation as well
Varonis also discovered a way to influence Copilot over the long term. This involved hiding a prompt injection within a web page’s metadata. When a user asked Copilot to summarize that page, the hidden instruction could end up in the assistant’s persistent memory.
That memory stores information and preferences across sessions. According to the researchers, an attacker could leave instructions there that would alter future responses, filter information, or trigger actions under certain conditions.
The manipulated information did not disappear when a user changed their password, logged out of sessions, or re-registered a device. Manual inspection of Copilot’s memory was required to discover such instructions.
Varonis has named these attack techniques “Co-Snitch.” The security firm had previously demonstrated other attacks in which a single click was enough to obtain data via Copilot.
AI reveals a lot about its own security
The discovery exposes an additional problem with the security of AI assistants. It’s not just about which commands a model refuses to execute. Information it provides during such a refusal can also be useful to an attacker.
In this case, Varonis gathered more and more information about Copilot’s technical limitations through a series of questions. Ultimately, the assistant revealed the undocumented parameter that allowed a key security measure to be bypassed.
The risk grows as AI assistants gain access to more corporate data and applications. A successful prompt injection can then not only produce an undesired response but also execute actions using the assistant’s permissions and data sources.
Microsoft says it has thanked the researchers for their report and is continuously updating its security measures to prevent similar attacks.