Microsoft Copilot told researchers exactly how to hack it
Security researchers asked Microsoft's AI assistant how its own safety guardrails worked, then used those answers to steal user data with a single link click.
Key points
- Researchers at security firm Varonis discovered a critical vulnerability in Microsoft 365 Copilot Enterprise in 2024.
- The exploit let an attacker steal passwords and sensitive data the moment a user clicked a malicious link, with no further action required.
- Researchers unlocked the attack not through reverse engineering but by questioning Copilot directly.
- Copilot disclosed an undocumented internal configuration parameter that bypassed user-confirmation entirely.
Microsoft 365 Copilot Enterprise is an AI assistant built into Microsoft's business tools. It can draft emails, search company files, execute commands on a user's behalf. That last capability is where things got dangerous.
Researchers at Varonis, a data-security company, set out to build an attack that would steal a user's data the moment that person clicked a malicious link. No typing, no confirming anything. One click, data gone.
What stopped them at first?
Copilot refused. Like most AI assistants, it had a built-in safety rule: before running any powerful command, it requires an explicit signal from the user, such as pressing the Enter key. That prevents a hidden instruction from quietly commandeering the assistant.
So the researchers tried something different. They asked Copilot to explain its own rules.
What followed was essentially twenty questions. They asked why automatic execution was blocked, which URL structures were involved in how Copilot loads pages, and what happens when a page opens with an instruction already typed into the prompt field. Each answer narrowed the gap.
How did the AI give away the secret?
Copilot answered every question honestly, and the researchers kept pulling the thread. Eventually it disclosed an undocumented configuration parameter that told Copilot to skip the user-confirmation step entirely.
With that in hand, the attack came together fast. A victim clicks a link. Copilot receives a hidden instruction carrying the parameter. The confirmation requirement vanishes. Passwords and sensitive data leave, with the victim unaware.
First reported by Ars Technica AI, the story illustrates a tension every AI system built on a large language model (the technology behind chatbots like ChatGPT and Copilot) now faces. These models are trained to be helpful and to explain themselves. That helpfulness turns into a liability when the person asking is mapping the defences.
We've been tracking Microsoft's Copilot closely this month: on 11 August we reported how AI tools needed fewer than 20 prompts to uncover a Zoom flaw that could hand attackers full device control, and the pattern here is similar enough to warrant attention from any organisation running AI assistants with action-taking privileges.
What should ordinary Microsoft 365 users do?
Varonis reported the vulnerability to Microsoft through responsible disclosure, giving the company time to fix it before going public. Confirm your organisation's Microsoft 365 environment is fully patched. IT teams managing those updates should already be across this.
Treat unexpected links in emails or messages with suspicion, even inside familiar business tools. An attacker still needs to deliver that malicious link to you somehow, which means phishing remains the front door.
My read: the detail that should concern enterprise buyers isn't that Copilot was vulnerable. It's that the vulnerability was unlocked through ordinary conversation. That's a new class of exposure, and most security teams aren't testing for it yet.
Common questions
Could this happen with other AI assistants, not just Microsoft's?
Potentially yes. Any AI assistant that can take actions on your behalf and explains its own rules when asked faces a version of this risk. Each product handles it differently, but the tension between helpfulness and safety is universal.
Is this fixed now?
Varonis notified Microsoft before publishing, following standard security practice. Microsoft hasn't publicly detailed the exact patch, but users on managed, up-to-date enterprise plans should be protected.
