Microsoft Copilot Vulnerability Allows Silent Data Exfiltration via Malicious Links
Security researchers from Varonis disclosed a vulnerability in Microsoft Copilot that allows attackers to bypass user confirmation and automatically execute prompts using specific URL parameters. By tricking a user into clicking a crafted link containing `?autorun=1` and `?q=`, the exploit can silently search and exfiltrate sensitive data like emails and credentials. This vulnerability highlights the significant security risks of integrating AI assistants with sensitive personal data and active user sessions. It demonstrates how easily traditional web vulnerabilities, like parameter manipulation, can be combined with AI capabilities to perform automated, silent data exfiltration. The attack chain executes completely even if the user closes the Copilot browser tab immediately after clicking the link. To avoid transmission errors and hide the theft, the prompt instructs Copilot to encode the stolen credentials into Base64 before sending them to an attacker-controlled server.
## BACKGROUND
AI assistants like Microsoft Copilot often have access to a user's active session and connected applications, such as email inboxes and calendars, to perform helpful tasks. However, this access can be exploited through prompt injection, where malicious instructions manipulate the AI into performing unauthorized actions. In this case, the vulnerability abuses URL parameters designed for quick-start prompts to force the AI to run commands without explicit user consent.