Varonis exploits Microsoft Copilot's hidden 'autorun=1' to steal user data

Security researchers at Varonis have demonstrated a critical vulnerability in Microsoft 365 Copilot for enterprise that allowed data exfiltration with a single click—and they discovered the flaw by interrogating the AI assistant itself. Rather than reverse engineering, the team asked Copilot about its own guardrails. Each refusal revealed technical details about the internal architecture, eventually leading to an undocumented prompt parameter: ?autorun=1. When combined with the well-known ?q= parameter, this secret flag bypassed the requirement for explicit user consent, causing prompts to execute silently the moment a victim clicked a maliciously crafted URL.

The attack workflow was straightforward: an attacker sends a link like https://copilot.microsoft.com/?q=&autorun=1 with embedded instructions. Once clicked, Copilot would search the victim's inbox, extract sensitive information like credentials or email addresses, and send them to an attacker-controlled webhook. Data was obfuscated in base64 format to hide the exfiltration. Microsoft mitigated the issue in February by disabling ?q= text injection, a move that also broke third-party browser integrations. On Tuesday, the company rolled out more comprehensive fixes. The case underscores how frontier AI models can be socially engineered to reveal their own secrets, highlighting a new class of supply-chain and data-leak risks.