Microsoft Copilot hacked via hidden URL parameter, leaks user emails

The vulnerability stems from Copilot's design allowing URL-embedded prompts to control the assistant's behavior—a feature intended to enable convenient shortcuts like opening Gmail or drafting emails. However, the undocumented autorun parameter bypasses the explicit user approval that was supposed to gate execution of these commands. By combining an unauthenticated attacker URL with a victim's authenticated Copilot session, the attack exploits a trust boundary that should not exist: the assistant executes attacker-supplied instructions with the privileges of a legitimate, logged-in user.

The second attack—poisoning Copilot's persistent memory—reveals an even deeper architectural weakness. Because Copilot retains user instructions and preferences across sessions without cryptographic verification or sandboxing, a single malicious webpage can permanently alter the assistant's behavior for that user. Future interactions will then execute the attacker's hidden rules, creating a persistent backdoor that survives even if the user deletes the original malicious link or message.

Both attacks succeed because Copilot conflates three security domains: the user's session context, the attacker-controlled input, and the assistant's decision-making. The guardrails that are supposed to prevent unauthorized actions—such as refusing to exfiltrate secrets or declining to execute unvetted instructions—fail when the prompt is injected before they can be evaluated by the user.