Researchers Trick Copilot Into Revealing Its Own Secrets, Then Exploit Them in One-Click Attack

Security researchers have demonstrated a new class of attack against Microsoft 365 Copilot that required only a single click from a victim — and the key to the exploit was handed over by Copilot itself. In a twist that underscores the unpredictable nature of LLM security, researchers at Varonis used the assistant's own guardrail explanations to reverse-engineer a critical bypass.

The attack, named "Co-Snitch," leverages an undocumented URL parameter that bypasses the user-consent gesture normally required before Copilot can execute powerful commands. When a victim clicks a crafted link, the prompt embedded in the URL fires automatically, with full access to the user's session context, connected apps, and memory — even if the tab is closed immediately.

The Self-Disclosed Exploit

Varonis researchers Lior Adar and his team knew they wanted to create a one-click exfiltration exploit. Like most AI assistants, Copilot refused to execute sensitive prompts without explicit user confirmation. But instead of reverse-engineering the guardrail, they simply asked Copilot how it worked, engaging in a 20-questions-style dialogue that gradually leaked architectural details.

"At the beginning, Copilot kept refusing, but every refusal revealed technical details about its internal architecture," Adar told Ars Technica. "Copilot eventually disclosed undocumented parameters. I took those parameters and used them for prompts for running automatically."

One such parameter was ?autorun=1. Combined with the standard ?q= prompt-injection parameter, it allowed a prompt to execute silently the moment the URL loaded:

https://copilot.microsoft.com/?q=&autorun=1

A malicious URL could be crafted to instruct Copilot to search the inbox for passwords or credentials and exfiltrate them to an attacker-controlled server, encoded in base64.

The attack sequence unfolds in five steps:

1. The victim clicks the attacker's crafted URL (delivered via email, chat, phishing page, QR code, etc.)
2. Browser loads copilot.microsoft.com in the victim's active, authenticated session
3. The ?autorun=1 parameter triggers auto-execution, and the ?q= prompt fires without any user gesture
4. Copilot processes the injected prompt with full access to the victim's session context, connected apps, and memory
5. The prompt executes to completion, including network fetches and connector invocations, even if the tab is closed immediately after load

Memory Poisoning

Varonis also developed a secondary attack that poisons Copilot's permanent memory store. By embedding instructions in a webpage's metadata, they could force Copilot to update the user's memory when summarizing the page. The poisoned memory persists across password changes, session revocations, and device re-enrollments, and could be used to bias responses, forward outputs, or execute attacker-defined actions on trigger conditions.

The only way to detect the tampered memory is manual inspection of its contents — a step most users will never take.

A Broader Pattern

Co-Snitch follows similar single-click attacks against Copilot Personal and the "SearchLeak" exfiltration technique discovered in June. Together, they highlight a fundamental weakness in LLM security: the reliance on reactive guardrails rather than proactive, architecture-level controls.

Microsoft silently mitigated the ?autorun=1 issue in February, three months after Varonis reported it, by requiring manual typing for ?q= injection. On Tuesday, the company introduced more comprehensive fixes. However, the underlying pattern — LLMs revealing internal architecture details when questioned about their own restrictions — is not unique to Microsoft and is likely to recur across other AI assistants.

For developers and security professionals, the lesson is clear: AI assistants are not just tools for productivity but also attack surfaces with emergent, often unpredictable behaviors. As these systems gain deeper access to our data, the guardrails that contain them remain a persistent weak link.