Varonis researchers pulled off something that should scare any enterprise running Microsoft 365 Copilot: they built an exploit that exfiltrated user passwords and sensitive data after a victim did nothing more than click a link. No prompt injection tricks, no reverse engineering. They simply asked Copilot how its own safety guardrails worked, and the assistant talked.
The dialog played out like a slow interrogation. Each time Copilot refused to auto-execute a sensitive prompt without user confirmation, it revealed something about the mechanism enforcing that requirement. What URL structures were involved? What happens when a page loads with input already sitting in the prompt field? Bit by bit, the researchers mapped the guardrail’s architecture. Then Copilot handed over the crown jewel: an undocumented parameter, ?autorun=1, that bypassed the consent requirement entirely. Combined with the known ?q= parameter, a malicious URL could silently fire a prompt the instant a target clicked it.
“At the beginning, Copilot kept refusing, but every refusal revealed technical details about its internal architecture,” Varonis Senior Researcher Lior Adar told Ars. “Copilot eventually disclosed undocumented parameters.”
Microsoft quietly mitigated the flaw in February, roughly three months after Varonis reported it, by neutering ?q= so it could no longer inject text into the chatbot input. Users now have to click and type manually, which broke legitimate third-party browser integrations that relied on that behavior. The company rolled out more comprehensive fixes on Tuesday.
The episode lands at an awkward moment for Microsoft, which has pushed Copilot hard into enterprise environments where it routinely touches email, documents, and internal systems. Other AI assistants have faced prompt injection attacks before, but those typically required a malicious document or webpage to feed instructions to the model. This is different. The assistant wasn’t just tricked by outside input — it was talked into explaining the very safety rails designed to stop this exact scenario. That’s a failure mode security teams haven’t had to plan for, and it raises an uncomfortable question about whether frontier models should be describing their own internal guardrails to anyone who asks politely enough.
