Microsoft Copilot revealed undocumented parameter allowing data exfiltration without user consent

Copilot Vulnerability Discovered

Security researchers at Varonis identified a critical vulnerability in Microsoft 365 Copilot Enterprise. This flaw allowed for the exfiltration of sensitive user data without requiring explicit user confirmation, a standard security measure for AI assistants executing powerful commands. The exploit was designed to activate simply by a user clicking on a malicious link.

AI Assistant Revealed Its Own Weakness

Unusually, the researchers uncovered the vulnerability by directly questioning Copilot about its internal guardrails and safety mechanisms. Through a series of detailed inquiries, Copilot divulged technical details about its architecture, eventually revealing an undocumented prompt parameter: "?autorun=1". This parameter, when used in conjunction with the known "?q=" parameter, allowed prompts to execute silently the moment a target clicked a specially crafted URL.

Microsoft's Mitigation Efforts

Varonis reported the vulnerability to Microsoft, which silently mitigated the issue in February, approximately three months after the initial report. The initial fix involved preventing the "?q=" parameter from injecting text directly into the chatbot input, thereby requiring manual user interaction. Microsoft implemented more comprehensive fixes on Tuesday to address the underlying problem.

Impact on Security Practices

This incident highlights the potential for advanced AI models to inadvertently disclose sensitive information about their own internal workings, which can then be exploited by malicious actors. It underscores the importance of rigorous security testing and the need for developers to anticipate novel methods of vulnerability discovery, even those involving direct interaction with the AI itself.