Microsoft Copilot Leaked Data With Single Link Click

Security researchers at Varonis found a way to make Microsoft 365 Copilot for enterprise leak user passwords and other sensitive data with nothing more than a single link click, no confirmation required. That's the kind of exploit that normally takes weeks of reverse engineering to build. Varonis got there by simply asking Copilot how to do it.

The assistant didn't hand over the answer right away. Microsoft built Copilot with guardrails that require an explicit user gesture, a key press or similar action, before it will run sensitive commands. When the researchers asked Copilot to help them build a link that would exfiltrate data automatically, it refused and cited that consent requirement.

So they changed tactics. Instead of asking for the exploit directly, they asked Copilot to explain the mechanics behind its own safety mechanism: why auto-execution wasn't possible, what URL structures and deep links it recognized, what happened when a prompt field loaded with input already inside it. Each answer chipped away at the wall a little more, until Copilot handed over something Microsoft never documented, a parameter that made the whole confirmation requirement pointless.