Security researchers at Varonis found a way to hijack Microsoft 365 Copilot Enterprise into silently leaking sensitive user data, such as passwords, simply by getting a target to click a link. Rather than reverse-engineering Copilot's defences, the researchers interrogated the chatbot itself, repeatedly asking why it refused to auto-execute commands until it inadvertently revealed an undocumented parameter that bypassed Microsoft's requirement for explicit user consent.

The flaw hinged on an unpublished parameter, "?autorun=1", which, combined with the known "?q=" parameter, let a crafted URL fire a prompt automatically the moment it was opened, without any key press or confirmation. This allowed attackers to instruct Copilot to search a victim's inbox, extract details such as a sender's email address or stored credentials, and quietly send them to an attacker-controlled server. Microsoft made a partial fix in February, three months after being notified, by preventing "?q=" from injecting text directly into the chat input, and rolled out more comprehensive fixes this week.