#Microsoft Copilot

Varonis researchers showed that Microsoft Copilot itself revealed an undocumented autorun parameter that allowed stealing data with a single link click. The vector was closed in February, but risks to the AI's memory remain.

Varonis specialists discovered a vulnerability in Microsoft Copilot that allowed stealing passwords and emails via a single link. The AI itself revealed the secret parameter ?autorun=1, which Microsoft has since patched.