Microsoft Copilot hacked via hidden URL parameter, leaks user emails

Key takeaway

• Researchers discovered that Microsoft Copilot can be hacked using a hidden URL parameter that forces the AI assistant to execute unauthorized prompts without user approval.

• When a victim clicks a crafted link, Copilot automatically extracts sensitive information—such as email addresses and passwords from the user's inbox—and sends it to an attacker's server in disguised format.

• A second attack method allows attackers to permanently poison Copilot's memory, potentially biasing future responses or triggering malicious actions across multiple sessions.

3 Key Points

Context & Analysis

FAQ

How does the attack work?

The attack uses an undocumented URL parameter (autorun=1) that triggers Copilot to automatically execute a hidden prompt without user approval. When a victim clicks the attacker's link, the browser loads Copilot in the victim's authenticated session, the autorun parameter fires the injected prompt, and Copilot processes it with full access to the victim's connected apps, inbox, and session memory—extracting and exfiltrating sensitive data even if the Copilot tab is closed immediately after.

What information can be stolen?

Attackers can instruct Copilot to extract email addresses from the victim's inbox, search for passwords or credentials that have been emailed to the address, and leak all of it to an attacker-controlled server. The stolen data is converted to base64 format to conceal the theft and prevent transmission errors.

How can the second attack compromise Copilot?

Researchers devised a prompt injection attack embedded in a webpage that poisons Copilot's permanent memory store—which saves user information, preferences, and instructions for use across future sessions. An attacker could use such an attack to forward outputs, filter information, bias responses toward attacker-chosen narratives, or execute attacker-defined actions on trigger conditions.