AI Governance Institute
← News
Research2026-08-18

Copilot Flaw Enabled One-Click Password Theft via Undocumented URL Parameter

What happened

Varonis security researchers disclosed a critical vulnerability in Microsoft 365 Copilot for enterprise, detailed in Microsoft Copilot reveals secret input that allowed it to be hacked. The attack required only a single click on a crafted link by the target user. The malicious link exploited an undocumented URL parameter, ?autorun=1, that Copilot itself disclosed when researchers queried the system iteratively, effectively using the AI to map its own attack surface. Once triggered, Copilot exfiltrated sensitive enterprise data including stored passwords without presenting the consent confirmation that is supposed to block unauthorized data access. Researchers also documented a second attack vector that poisoned Copilot's persistent memory, allowing a compromised state to survive password changes and session revocations. This incident follows a pattern of Copilot-specific exfiltration risks previously reported, including the CoSnitch vulnerability that also turned Copilot into a data exfiltration channel.

Why it matters

  • ·The consent guardrail bypass is a direct control failure: enterprise deployments that rely on Copilot's built-in confirmation prompts as a data-access safeguard cannot treat those prompts as a reliable security boundary until Microsoft confirms the fix scope and deployment status.
  • ·The persistent memory poisoning vector extends the blast radius well beyond a single session. Because the compromised state survived credential resets, organizations using Copilot in environments governed by the OWASP Top 10 for Large Language Model Applications or similar frameworks must treat memory and connector state as independent attack surfaces requiring their own controls.
  • ·The fact that Copilot disclosed the exploitable parameter through iterative questioning signals a systemic AI security testing gap: standard penetration testing and vendor security assessments did not surface this vector, exposing weaknesses in pre-deployment and ongoing adversarial testing programs for enterprise AI tools.

Governance controls affected

AGT-002Agent Prompt Injection DefenseAGT-003Agent Memory and Context GovernanceAGT-001Agent Permission BoundariesSEC-001Prompt Injection PreventionSAF-006Post-Deployment Adversarial Testing Cadence

What to do now

  • ☐Contact your Microsoft account team to confirm whether the ?autorun=1 vulnerability has been patched in your tenant and obtain written confirmation of the fix scope before resuming normal Copilot operations.
  • ☐Audit current Copilot connector permissions and revoke any connectors with access to credential stores, HR systems, or other sensitive data repositories until the patch status is verified.
  • ☐Review your Copilot memory and persistent state settings and disable or restrict memory persistence for users handling sensitive data, treating memory as an untrusted data surface until further guidance is available.
  • ☐Update your adversarial testing program to include iterative prompt-based discovery of undocumented parameters and hidden API behaviors in all enterprise AI assistant deployments, not just external-facing models.
  • ☐Trigger your AI incident response playbook to assess whether any production tenants were exposed during the window between vulnerability discovery and patch availability, and document findings for potential regulatory notification obligations.

What to watch next

Microsoft has not yet published a comprehensive public advisory detailing which tenants were affected, the patch timeline, or whether telemetry indicates active exploitation before disclosure. Compliance teams should monitor the Microsoft Security Response Center for a formal CVE assignment and patch confirmation. The growing frequency of prompt injection and memory-poisoning disclosures targeting enterprise productivity AI, including prior Copilot incidents and the broader pattern flagged across agentic platforms, suggests regulators scrutinizing AI vendor security practices under frameworks such as the EU Cyber Resilience Act may use incidents like this to calibrate disclosure and patching timeline expectations for AI vendors.

Stay ahead of stories like this

Get every Global AI governance development like this one, plus the rest of the week's developments. Every Thursday.

Powered by Buttondown.

Related Coverage

Research2026-09-04

ASCII Smuggling Bridges Email Phishing and AI Prompt Injection at Scale

Microsoft researchers documented a phishing campaign exceeding 2.37 million messages that repurposed ASCII smuggling, a technique originally associated with AI prompt injection, to evade email content filters using invisible Unicode characters. The campaign targeted financial keywords and ran from late February through mid-June 2026 across roughly 150 disposable domains. Microsoft's recommended defense, stripping invisible Unicode before content evaluation, applies equally to email filters and AI assistant input pipelines.

Research2026-08-25

InjecMEM Plants Persistent Agent Instructions via Single Prompt, 76.6% Success Rate

Researchers from Shanghai Jiao Tong University and Ant Group have demonstrated InjecMEM, an attack technique that injects malicious instructions into AI agent memory systems through a single ordinary interaction, without requiring direct access to the memory store. The attack persists across sessions, achieving a 76.6% success rate against the MemoryOS system. Experts warn that inference-time input and output filtering, the most common enterprise defense, does not stop this class of attack.

Research2026-09-02

Cyble's 2026 Report Codifies Untrusted-Input and Least-Privilege as Baseline Agent Controls

Cyble's AI Threat Landscape Report 2026 catalogues the attack surfaces surrounding agentic AI deployments, including prompt injection, RAG poisoning, vector store manipulation, and API credential theft. The report recommends that enterprises treat all content ingested by AI systems as untrusted, enforce least-privilege boundaries for every agent, and conduct adversarial red teaming as a standard operational control. Its findings represent a threat-intelligence codification of risks that regulators and auditors are increasingly treating as the baseline for reasonable AI security.