Microsoft Copilot Revealed a Secret Parameter to Hackers for Stealing Passwords: How AI Exposed the Vulnerability Itself

The Secret Parameter Revealed by the AI Itself

In August 2026, specialists from the company Varonis discovered a critical vulnerability in the corporate assistant Microsoft 365 Copilot. During the investigation, experts found that the AI system, designed to assist users, could become a tool for stealing confidential data. The uniqueness of the situation lay in the fact that Copilot itself provided researchers with a detailed instruction on how to bypass security systems, naming an internal parameter ?autorun=1, which allowed malicious commands to be executed without user confirmation.

Attack Mechanics: From Link to Leak

Researchers demonstrated how attackers could exploit this vulnerability. It was sufficient to form a link to copilot.microsoft.com with the parameters ?q= (query) and ?autorun=1 (automatic execution). Upon clicking such a link, the query was executed instantly, without the need to press Enter or perform other actions. Copilot began scanning the victim's email, extracting passwords, session keys, and other sensitive data, encoding them in Base64, and sending them to the hacker's server. Notably, the attack worked even if the user immediately closed the tab with the chatbot.

Poisoning AI Memory: Long-term Consequences

In addition to the direct theft of data, Varonis experts identified the possibility of "poisoning" Copilot's long-term memory. Using a malicious prompt hidden in the metadata of a web page, attackers could overwrite the bot's basic instructions. These changes persisted even after changing passwords or restarting the session, forcing the AI to constantly redirect answers and data to hacker servers. This created a long-term threat for corporate users, whose data could be compromised without their knowledge.

Microsoft's Response and Current Vulnerability Status

Following the publication of the study, Microsoft promptly released patches to close the vulnerability. The company confirmed that the parameter ?autorun=1 had been removed from the system, and users are no longer at risk of automatic execution of malicious commands. However, experts emphasize that this case clearly demonstrated the unreliability of current security mechanisms for LLM models. Even with protective filters in place, AI may inadvertently reveal critical vulnerabilities if properly "nudged" during a dialogue.

Contradictory Data

There are discrepancies in the sources regarding the details of the attack description. Some publications (e.g., 3dnews.ru) emphasize that the vulnerability allowed data theft "with a single mouse click," while others (rbc.ua) indicate that activating the exploit required clicking on a specially formed link. There are also disagreements regarding the scale of the threat: some sources call it a "critical vulnerability," while others describe it as a "serious but local risk." Microsoft has not provided official comments regarding the exact number of affected users, leaving room for interpretation.