Microsoft Copilot Leaked Its Own Secret Backdoor to Researchers

Security researchers at Varonis were probing Microsoft 365 Copilot to understand how its permission boundaries work, and the AI turned out to be terrible at keeping corporate secrets.

Instead of hitting a brick wall, the researchers started interrogating the chatbot about why direct prompt execution was blocked and how deep links functioned. After a persistent sequence of technical questions, Copilot surrendered an undocumented internal query parameter: ?autorun=1.

Combined with standard search query parameters, this secret flag bypassed the mandatory user consent prompt entirely. An attacker simply had to convince an authenticated user to click a specially crafted URL.

The exploit allowed attackers to silently search the victim's inbox for passwords or confidential emails and exfiltrate the base64-encoded loot to an external server. The extraction chain completed entirely in the background, even if the victim closed the browser tab immediately after opening the link.

The team also demonstrated a memory-poisoning technique where hidden metadata on a web page could permanently alter Copilot's long-term memory, persisting across session resets and device re-registrations until manually deleted. Microsoft addressed the vulnerability months later by disabling automated text insertion through URL parameters.

Complex zero-days and memory exploits are rapidly taking a back seat to simply asking conversational AI models how to break their own security guardrails. Granting automated assistants unfettered access to internal enterprise communications while teaching them to execute remote instructions remains a masterclass in modern digital convenience.

Source: Ars Technica