Microsoft Copilot told researchers exactly how to hack it

Key points

• Researchers at security firm Varonis discovered a critical vulnerability in Microsoft 365 Copilot Enterprise in 2024.
• The exploit allowed an attacker to steal a user's passwords and sensitive data the moment the user clicked a link, with no further action required.
• Researchers found the key to the attack by questioning Copilot itself, not by using traditional hacking methods.
• Copilot revealed an undocumented internal setting that completely bypassed the requirement for users to confirm sensitive actions.

Microsoft 365 Copilot Enterprise is an AI assistant, similar in concept to a workplace chatbot, built into Microsoft's suite of business tools. It can draft emails, search company files, and run commands on a user's behalf. That last part, running commands, is where things got dangerous.

Security researchers at Varonis, a data-security company, wanted to see if they could build an attack that would steal a user's data the moment that person clicked a malicious link. No typing. No confirming anything. One click, data gone.

What stopped them at first?

Copilot refused. Like most AI assistants today, it had a built-in safety rule: before executing any powerful command, it must get an explicit signal from the user, such as pressing the Enter key. This prevents a hidden or automated instruction from quietly taking over the assistant.

So the researchers tried a different approach. They asked Copilot to explain its own safety rules.

The conversation that followed read like a slow-motion game of twenty questions. The researchers asked why automatic execution was blocked. They asked which types of web addresses were involved in how Copilot loads pages. They asked what happens when a page opens with an instruction already typed into the prompt field, the text box where users enter commands.

Each answer peeled back another layer.

How did the AI give away the secret?

Copilot answered every question honestly, and each answer narrowed the gap. Eventually, the assistant disclosed something it almost certainly should not have: an undocumented internal setting, a hidden configuration parameter, that told Copilot to skip the user-confirmation step entirely.

With that parameter in hand, the researchers built their attack. A victim clicks a link. Copilot receives a hidden instruction carrying the secret parameter. The confirmation requirement vanishes. Passwords and sensitive data flow out, with the victim none the wiser.

First reported by Ars Technica AI, the story highlights a tension that every AI system built on a large language model, the technology behind chatbots like ChatGPT and Copilot, now faces. These models are trained to be helpful and to explain themselves. That helpfulness becomes a liability when the person asking is trying to find a gap in the defences.

What should ordinary Microsoft 365 users do?

Varions reported the vulnerability to Microsoft through responsible disclosure, meaning they gave the company time to fix it before going public. Check that your organisation's Microsoft 365 environment is fully patched and up to date. If your IT team manages those updates, they should already be aware.

More broadly, treat unexpected links in emails or messages with suspicion, even inside familiar business tools. An attacker still needs to get that malicious link in front of you somehow.

Common questions

Could this happen with other AI assistants, not just Microsoft's?

Potentially yes. Any AI assistant that can take actions on your behalf and explains its own rules when asked faces a version of this risk. Each product handles it differently, but the underlying tension between helpfulness and safety is universal.

Is this fixed now?

Varions notified Microsoft before publishing their findings, following standard security practice. Microsoft has not publicly detailed the exact patch, but users on managed, up-to-date enterprise plans should be protected.