This incident matters less as a one-off Copilot bug than as a design warning for enterprise AI integrations: once an assistant accepts URL-delivered state, deep-link parameters become part of the attack surface. The notable failure here is not only prompt injection, but the collapse of a trust boundary between navigation, prefilled input, and command execution. For IT teams deploying copilots inside productivity suites, that boundary deserves the same scrutiny normally given to SSO callbacks, custom URI handlers, and browser extension permissions.
A practical takeaway is that AI guardrails cannot be treated as a purely model-layer control. If execution safety depends on user confirmation, that requirement must be enforced by the client and service architecture in ways that cannot be bypassed by hidden parameters, prepopulation tricks, or undocumented integration hooks. Security reviews should therefore test every path that can pass context into the assistant: URL parameters, embedded widgets, add-ins, browser extensions, mobile deep links, and automation connectors.
There is also a governance lesson for vendors and enterprise adopters. When the model can disclose implementation details about its own controls, internal mechanics effectively become reachable through conversation. That raises the bar for red-team testing, telemetry, and feature hardening around “explain your behavior” interactions. Security teams should ask whether copilots expose undocumented actions, whether logs capture parameter-driven launches, and whether detections exist for abnormal prompt origination patterns. In AI-enabled business apps, convenience features that reduce friction for users can also reduce friction for attackers.
It’s not every day that attackers can force a frontier AI model to cough up user passwords and other sensitive data without user confirmation. That’s exactly what researchers recently did to Microsoft 365 Copilot Enterprise. Even more unusual is the source they tapped to discover the critical vulnerability that made their exploit possible. Rather than employing reverse engineering or other traditional vulnerability-hunting methods, they asked Copilot. The LLM assistant readily complied.
Researchers at security firm Varonis knew they wanted to create an exploit that would exfiltrate user data when a user did nothing more than click on a link. Like most AI assistants today, Copilot steadfastly refused and made clear that sensitive prompts like that require explicit user consent in the form of a gesture, such as pressing a return key or other key. In response, the researchers peppered Copilot with questions about the guardrails that required user confirmation before the assistant can execute powerful commands.
Loose lips sink ships
The dialog was like a game of 20 questions. Each answer provided a new clue that divulged information about the complex safety mechanism. Why was auto-execution impossible, they asked. What URL structures and deep links were involved? What happens when a page is loaded with input already in the prompt field? Each answer provided a deeper view into the guardrail and its limits. Eventually, Copilot provided a stunning Microsoft trade secret—an undocumented prompt parameter that completely bypassed the requirement for user consent.
“At the beginning, Copilot kept refusing, but every refusal revealed technical details about its internal architecture,” Varonis Senior Researcher Lior Adar said in an interview. “Copilot eventually disclosed undocumented parameters. I took those parameters and used them for prompts for running automatically.”
The parameter was the string ?autorun=1. When accompanied by the separate, well-known parameter ?q=, the researchers’ prompt silently fired the moment the target clicked on the malicious URL. Microsoft silently mitigated the vulnerability in February, three months after Varonis reported it, by no longer allowing ?q= to inject text into the chatbot input. The user instead had to click and type manually, a requirement that prevented third-party browser integrations from using the parameter as intended. Microsoft introduced more comprehensive fixes on Tuesday.
Enjoyed this article? Sign up for our newsletter to receive regular insights and stay connected.