Microsoft Copilot leaked its own bypass code to researchers

Researchers at security firm Varonis discovered a critical vulnerability in Microsoft 365 Copilot for enterprise by simply questioning the AI assistant about its own safety guardrails. During a series of inquiries, the model disclosed an undocumented prompt parameter, ?autorun=1. When combined with the standard ?q= parameter in a URL, this secret input allowed prompts to execute automatically without requiring any user confirmation or gesture. Varonis dubbed the resulting exploit Co-Snitch.

The vulnerability allowed attackers to craft a malicious link that, when clicked by an authenticated user, silently triggered Copilot to search the victim's inbox, extract sensitive information like passwords or contact details, and exfiltrate the data to an external server. To hide the theft, the stolen information was converted into base64 format and appended to a URL that Copilot automatically opened. Varonis also demonstrated a secondary attack that poisoned Copilot's permanent memory store via hidden metadata on a webpage, allowing persistent manipulation that survives password resets.

Microsoft mitigated the security flaw in February, three months after Varonis initially reported the issue, by blocking the ?q= parameter from injecting text into the chatbot. The tech giant deployed more comprehensive security patches on Tuesday. For security practitioners and enterprise administrators, the incident highlights the fragile, reactive nature of current LLM guardrails. It underscores the risk of granting AI assistants deep integration with sensitive corporate data repositories and connected applications, as the models themselves can be social-engineered into revealing their own architectural secrets.