Microsoft Copilot reportedly leaked undocumented parameter enabling password theft via link clicks

The vulnerability stemmed from Copilot’s own disclosures during a dialogue with researchers. By probing the assistant for details about its guardrails, the team extracted an undocumented parameter that bypassed the requirement for explicit user consent. This parameter, `?autorun=1`, enabled automatic execution of prompts when combined with the standard `?q=` parameter in a URL. The attack required no reverse engineering or code analysis, just persistent questioning of the LLM itself.

The exploit’s impact was severe: a single click on a crafted link could trigger Copilot to search a victim’s inbox for passwords or other sensitive data and exfiltrate it to an attacker-controlled server. The data was appended to a URL and encoded in base64 to evade detection. This method worked within the victim’s authenticated session, leveraging Copilot’s access to connected apps and memory. The attack surface was broad, as links could be delivered via email, chat, or phishing pages.

Microsoft’s initial fix in February disabled the ability for `?q=` to inject text into the chatbot input, forcing users to manually type or click. This broke third-party browser integrations that relied on the parameter for legitimate automation. A more comprehensive update followed, though the details of the additional changes remain unclear. The incident highlights the risks of undocumented parameters in AI systems, where even safety mechanisms can become attack vectors if exposed.

The broader implication is the fragility of AI guardrails when faced with targeted interrogation. Unlike traditional software vulnerabilities, this flaw was discovered through conversation, not code analysis. The LLM’s responses inadvertently revealed internal architecture details, which were then weaponized. This suggests that AI systems may require stricter controls on what information they disclose, even in seemingly innocuous interactions.