Varonis specialists found a way to turn Microsoft 365 Copilot, a corporate assistant, into a real spy: the victim only needs to click a malicious link once, and the bot will send passwords from email to attackers on its own. The most curious part is that Copilot itself revealed the decisive secret.
How Copilot revealed its main secret
The researchers started simple: they began asking Microsoft 365 Copilot questions about its own security system. When the bot rejected a command, it usually explained why. These explanations, accumulating, revealed the service's inner workings. Eventually, the specialists stumbled upon an undocumented parameter ?autorun=1. It worked in tandem with the standard ?q=: if you give a user a link like https://copilot.microsoft.com/?q=&autorun=1, the query text executes automatically the moment the person clicks the link. No additional confirmation is required.
What malicious prompts could do
Using such a "hole," it was possible to make the bot execute entire scenarios. One of the checks looked like this: Copilot had to take the latest email from the inbox, extract the sender's address from it, and open a URL on webhook.site — effectively sending data outside. Another option was far more dangerous: the bot received a command to find passwords and logins in email, then forward them to a server controlled by the attacker. To prevent the stolen data from being damaged during transmission and to avoid attracting attention, it was encoded in base64.
Co-Snitch: an attack on the assistant's memory
The researchers didn't stop there. They came up with a way to infect Microsoft 365 Copilot's memory itself. If a user asks the bot to summarize the contents of a web page that has hidden instructions embedded in it, the bot executes those instructions and changes its saved data about the person. Worst of all, such changes survive password changes, revocation of all sessions, and even re-registration of devices. The attack was named Co-Snitch — a continuation of Varonis's previous experiments with Copilot Personal.
Microsoft's response and conclusions
Microsoft closed the critical vulnerability in February, three months after Varonis reported it. The first patch simply banned ?q= from inserting text into the chat field, and on Tuesday the company released a more comprehensive fix. But the story itself is telling: AI assistants with access to email and personal data can become an ideal leak channel, and no "smart" filter guarantees security. Prompt-based attacks are not science fiction, but a reality that both developers and users will now have to live with.
