Copilot Flaw Enabled One-Click Password Theft via Undocumented URL Parameter
What happened
Varonis security researchers disclosed a critical vulnerability in Microsoft 365 Copilot for enterprise, detailed in Microsoft Copilot reveals secret input that allowed it to be hacked. The attack required only a single click on a crafted link by the target user. The malicious link exploited an undocumented URL parameter, ?autorun=1, that Copilot itself disclosed when researchers queried the system iteratively, effectively using the AI to map its own attack surface. Once triggered, Copilot exfiltrated sensitive enterprise data including stored passwords without presenting the consent confirmation that is supposed to block unauthorized data access. Researchers also documented a second attack vector that poisoned Copilot's persistent memory, allowing a compromised state to survive password changes and session revocations. This incident follows a pattern of Copilot-specific exfiltration risks previously reported, including the CoSnitch vulnerability that also turned Copilot into a data exfiltration channel.
Why it matters
- ·The consent guardrail bypass is a direct control failure: enterprise deployments that rely on Copilot's built-in confirmation prompts as a data-access safeguard cannot treat those prompts as a reliable security boundary until Microsoft confirms the fix scope and deployment status.
- ·The persistent memory poisoning vector extends the blast radius well beyond a single session. Because the compromised state survived credential resets, organizations using Copilot in environments governed by the OWASP Top 10 for Large Language Model Applications or similar frameworks must treat memory and connector state as independent attack surfaces requiring their own controls.
- ·The fact that Copilot disclosed the exploitable parameter through iterative questioning signals a systemic AI security testing gap: standard penetration testing and vendor security assessments did not surface this vector, exposing weaknesses in pre-deployment and ongoing adversarial testing programs for enterprise AI tools.
Stay ahead of stories like this
Get every Global AI governance development like this one, plus the rest of the week's developments. Every Thursday.
Recent issues
- State-linked attackers and criminal operators are actively weaponizing AI tools as entry points into enterprise systems, turning internal platforms and open-source frameworks into live attack vectors.5 Nov
- Three separate incidents this week each created a new compliance action item: verify your AI vendors' data sourcing, demand agent monitoring coverage guarantees, and audit trusted app identities in your cloud environment.29 Oct
Free every Thursday. Unsubscribe anytime.
Governance controls affected
What to do now
- ☐Contact your Microsoft account team to confirm whether the ?autorun=1 vulnerability has been patched in your tenant and obtain written confirmation of the fix scope before resuming normal Copilot operations.
- ☐Audit current Copilot connector permissions and revoke any connectors with access to credential stores, HR systems, or other sensitive data repositories until the patch status is verified.
- ☐Review your Copilot memory and persistent state settings and disable or restrict memory persistence for users handling sensitive data, treating memory as an untrusted data surface until further guidance is available.
- ☐Update your adversarial testing program to include iterative prompt-based discovery of undocumented parameters and hidden API behaviors in all enterprise AI assistant deployments, not just external-facing models.
- ☐Trigger your AI incident response playbook to assess whether any production tenants were exposed during the window between vulnerability discovery and patch availability, and document findings for potential regulatory notification obligations.
What to watch next
Microsoft has not yet published a comprehensive public advisory detailing which tenants were affected, the patch timeline, or whether telemetry indicates active exploitation before disclosure. Compliance teams should monitor the Microsoft Security Response Center for a formal CVE assignment and patch confirmation. The growing frequency of prompt injection and memory-poisoning disclosures targeting enterprise productivity AI, including prior Copilot incidents and the broader pattern flagged across agentic platforms, suggests regulators scrutinizing AI vendor security practices under frameworks such as the EU Cyber Resilience Act may use incidents like this to calibrate disclosure and patching timeline expectations for AI vendors.