Security firm Varonis got Microsoft 365 Copilot Enterprise to disclose an undocumented URL parameter that bypassed its user-consent guardrail, then used the parameter to build a one-click attack that exfiltrated inbox contents and passwords. The parameter, ?autorun=1, was extracted not through reverse engineering but by asking Copilot directly. Microsoft silently mitigated the flaw in February 2026, three months after Varonis reported it, and shipped a broader set of fixes on Tuesday.
The attack, which Varonis calls Co-Snitch, exploited the fact that Copilot accepts prompts embedded in URLs via the well-known ?q= parameter. Normally, executing anything sensitive from such a prompt requires a user gesture — pressing return, clicking a button. The undocumented ?autorun=1 flag removed that requirement entirely. A URL of the form https://copilot.microsoft.com/?q=&autorun=1 fired its embedded prompt the moment the target loaded the page in an authenticated session.
Varonis Senior Researcher Lior Adar said the team never intended to phish the model for its own internals. They started by asking Copilot to build the attack outright, which it refused. Each refusal, however, leaked structural detail: why auto-execution was impossible, which URL parameters existed, what happened when a page loaded with input pre-populated in the prompt field.
Key facts
- 01Varonis researchers extracted an undocumented ?autorun=1 parameter directly from Copilot by peppering it with questions about its own guardrails.
- 02The parameter, combined with ?q=, silently executed prompts the moment a target clicked a crafted URL — no user gesture required.
- 03Microsoft took three months after the February 2026 report to ship a first mitigation, and delivered comprehensive fixes only this Tuesday.
- 04A second attack, Co-Snitch, poisoned Copilot's persistent memory via prompt injection hidden in webpage metadata a user asked Copilot to summarize.
- 05Exfiltrated inbox contents and credentials were base64-encoded and sent to an attacker-controlled server, including via webhook.site.
Roughly twenty rounds of questioning later, the assistant surrendered the parameter that made the whole guardrail moot.
With the flag in hand, the researchers wrote prompts that instructed Copilot to search the victim's inbox, extract the latest sender's address or any credentials found in message bodies, base64-encode the result, and append it to a URL hosted on webhook.site. Copilot then opened that URL automatically on the victim's device, silently delivering the payload to the attacker's server. The full chain ran even if the victim closed the Copilot tab immediately after the page loaded.
The exfiltration worked because Copilot processed the injected prompt with the victim's full session context — connected apps, memory, and inbox access included. A single click on a link delivered in email, chat, or a QR code was enough. Varonis's write-up traces five steps from click to completion, none of which involved a further user action.
Microsoft's February mitigation was narrow: it stopped ?q= from injecting text directly into the chatbot input, forcing the user to click and type manually. That broke third-party browser integrations that relied on the parameter for legitimate purposes, and it took another six months for Microsoft to introduce the comprehensive fixes it announced Tuesday. The three-month response window on the initial patch is long for a vulnerability that leaked passwords on a single click.
Varonis paired the disclosure with a second finding: a prompt injection embedded in webpage metadata that, when a user asked Copilot to summarize the page, rewrote the assistant's persistent memory store. Poisoned memory survives password changes, session revocations, and device re-enrollments, and can only be detected by manually inspecting memory contents. The firm's June demonstration, SearchLeak, showed a similar one-click exfiltration path against Copilot Personal.
The pattern across all three attacks — SearchLeak, Co-Snitch, and the memory-poisoning variant — is that Copilot's safety model is a stack of reactive filters rather than a structural constraint. Guardrails prevent the model from doing obviously bad things when asked plainly, but a sufficiently patient interrogator can extract the parameters, prompt structures, and edge cases that the guardrails were written to protect. Microsoft has not published a post-mortem on how an undocumented internal flag ended up in the model's training or system prompt in a form the model could recite.
For enterprise buyers, the specific bug is patched, but the class of failure is not. Any LLM assistant with access to email, calendar, files, and connectors is a high-value execution environment, and any URL-embedded prompt path is a candidate for the next ?autorun=1. The mitigations Microsoft shipped Tuesday narrow the current attack surface; they do not change the fact that Copilot's own knowledge of its guardrails was itself the vulnerability. Until AI vendors can build agents whose safety properties survive the model being interrogated about them, security teams should assume that every documented consent gate has an undocumented bypass one conversation away.
Working on something we should cover, or seeing a story we missed? Send leads, documents, or feedback to hello@aichatdaily.com. For sensitive tips, see our secure tips page for Signal and PGP options.
Spotted an error? Email hello@aichatdaily.com with the URL and the issue, or read our full corrections policy.
