Technology media Ars Technica reported on August 18 that security company Varonis discovered a security vulnerability in Microsoft Copilot. Attackers can exploit the ?autorun=1 parameter combined with ?q= to bypass user confirmation and directly steal information. Similar to most AI assistants, Copilot supports receiving prompts via URL. The basic part can trigger applications like Gmail, while subsequent parameters can request summarizing the inbox or drafting emails.

image.png

Five-step attack chain, data transmitted using Base64

Researchers created a link like https://copilot.microsoft.com/?q=&autorun=1: when users click it, Copilot loads in the already logged-in session, and autorun=1 triggers automatic execution, allowing the prompt in ?q= to run without any gestures. The injected instructions can search the inbox, extract sender addresses or password credentials, store them in variables, and then send them to a webhook URL controlled by attackers, which is automatically opened, leading to the leakage of sensitive data.

To hide their tracks, the transmitted content is first converted into Base64. The complete attack chain consists of five steps: the victim clicks on a carefully constructed link → Copilot loads in the authenticated session → the parameter triggers automatic execution → Copilot gains full access to the session context, connected applications, and memory → even if the tab is closed immediately, the prompt will still be executed, including online retrieval and multi-turn chain operations. This vulnerability warns that once an AI assistant is integrated with a private account, a "single-link" can turn into a privacy backdoor.