Researchers discovered an undocumented autorun=1 parameter in Microsoft’s Copilot that lets attackers embed prompts directly into URLs. A crafted link such as https://copilot.microsoft.com/?q=&autorun=1 can trigger Copilot to scan a user’s Gmail and send sensitive data to an attacker‑controlled endpoint. One injection extracted the latest sender’s address, stored it in a variable named SUPPORT, and posted it to a webhook.site URL. Another prompt searched for passwords in the inbox, exfiltrating any found credentials in base64‑encoded form. The attacker delivers the link via email, chat, or a QR code; once clicked, Copilot runs the hidden prompt without user approval, even if the browser tab closes immediately. Varonis outlined the steps and later revealed a second attack that poisoned Copilot’s permanent memory store via hidden metadata, enabling future biased responses or automated actions. The vulnerability shows that Copilot’s guardrails can be bypassed, exposing users to data theft and manipulation.

Microsoft has not yet issued a patch, but recommends users review Copilot’s permissions and avoid clicking suspicious links. Security teams should monitor outbound traffic for unexpected API calls from Copilot and consider disabling the autorun feature where possible.