Microsoft Copilot Talked Researchers Through Its Own Security Bypass

Microsoft's AI assistant helped researchers hack it. Not by accident, by explaining itself to death.

Varonis Threat Labs wanted to know if they could get Microsoft 365 Copilot to leak sensitive user data from a single click, no extra confirmation needed. Copilot said no. It told them, correctly, that sensitive actions require an explicit user gesture like pressing Enter.

So the researchers kept asking why. According to Ars Technica, Lior Adar, a senior researcher at Varonis, described the process as a running interrogation: why is auto-execution impossible, what URL structures are involved, what happens when a prompt field gets pre-filled. Copilot answered every question.

"At the beginning, Copilot kept refusing, but every refusal revealed technical details about its internal architecture," Adar said. "Copilot eventually disclosed undocumented parameters. I took those parameters and used them for prompts for running automatically."

The payoff was a string Microsoft never documented anywhere: autorun=1. Combined with a known parameter called ?q=, that string let a malicious link fire a prompt into Copilot the instant a target clicked it. No confirmation box. No visible sign anything happened.

The Register, which reviewed the research in advance, reported that Varonis named the flaw "CoSnitch" and reported it to Microsoft in December 2025. The firm calls its technique "meta-hacking": social-engineering the model's own reasoning process instead of reverse-engineering code. Varonis said Copilot even explained the exact session conditions needed to trigger the bypass and described the content-filtering gaps between the first response and later ones in the same conversation.

Microsoft's fix came in stages. Ars Technica reported the company quietly disabled the ?q= parameter's ability to auto-populate the chat field in February, three months after the initial report, forcing users to manually type prompts instead of having links do it for them. That broke the convenience third-party browser tools relied on, but it also closed the door attackers had been using. The Register reported Microsoft was set to issue a formal patch and assign a CVE number on Tuesday, closing out the more comprehensive fix.

There's no indication in either report that this vulnerability was exploited against real users before Microsoft patched it. This was a disclosed research finding, not an active breach.

A separate, unresolved problem in Word

While Varonis was picking apart Copilot's URL handling, a different researcher was finding trouble inside Word documents themselves.

Håkon Måløy disclosed a technique on July 28, according to The Hacker News, in which hidden text inside a Word document, white lettering at eight-point font, invisible to a human reader, gets passed straight into Copilot's context because Word strips color and font formatting before sending text to the model. The AI can't tell the difference between a legitimate instruction from the user and a buried instruction planted by whoever wrote the document.

In Måløy's proof of concept, Copilot halved every financial figure in a report and then copied the hidden instructions into the new file it generated, in the same invisible white text, disclosing none of it. When that newly poisoned document was later used as a source in a different Copilot session, the same manipulation fired again, halving figures in a completely separate draft.

Måløy reported the issue to Microsoft, which confirmed the behavior on March 31 and rolled out two mitigations: blocking the specific prompt wording he used, then upgrading the underlying model to GPT-5.5. Neither held. Måløy said the attack worked again with modified wording on GPT-5.6, and confirmed the underlying flaw still reproduced as of his July 28 publication date, 144 days after his initial report.

"The vulnerability class therefore remains exploitable at the time of publication," Måløy said, according to The Hacker News.

This isn't a zero-click worm. It requires a Copilot drafting or editing session, and the poisoned document has to actually enter the model's context, either as a direct attachment or because Work IQ, Copilot's file-relevance engine, decides on its own to pull it in from OneDrive. Måløy's own proof of concept needed his tainted file to get flagged as relevant by that system. He also withheld the full attack payload from publication and reported no evidence of it being used against real organizations.