Copilot confessed its own bypass password when repeatedly questioned

Varonis researchers set out from the start to break that principle. They wanted to build an attack that exfiltrated data from a single link click, with no further action from the user. Copilot initially refused firmly, insisting that sensitive requests always required explicit user action. The researchers changed tack, probing Copilot step by step: why automatic execution wasn't possible, which URL structures and deep links were involved, and what would happen if a page loaded with the prompt input field already pre-filled.

The vulnerability Copilot confessed on its own

As the interrogation-style dialogue continued, Copilot's answers gradually revealed the internal structure of its safeguards. Lior Adar, principal researcher at Varonis, told Ars Technica that "every refusal exposed technical details about the internal architecture." Eventually, Copilot revealed Microsoft's undocumented parameter, ?autorun=1. When this value was combined in a URL with the already-known ?q= parameter, the prompt executed the instant a user clicked the link — with no separate approval required.

The link the researchers built extracted the most recent sender's email address from the victim's inbox, appended it to a specific webhook address, and instructed Copilot to summarize that URL. A separately crafted prompt had Copilot search the inbox for sensitive information such as passwords and exfiltrate it the same way. The stolen data was converted to base64 and automatically sent to an attacker-controlled page, and the process completed even if the user immediately closed the Copilot tab. A blog post Varonis published on Tuesday laid out the attack flow in five steps: once a victim clicks the link, ?autorun=1 triggers automatic execution within their authenticated session; the ?q= prompt fires without any user action; and Copilot then accesses connected apps and memory to carry the command through to completion.

Three months after the report, in February, Microsoft applied an initial mitigation that blocked the ?q= parameter from injecting text directly into the chat window. This forced users to click and type manually, but it also broke third-party browser integrations that relied on the parameter working normally. On Tuesday, Microsoft released a more comprehensive fix that fully closed the vulnerability.

A second attack that tampers with memory itself

In the course of the same investigation, Varonis found a separate attack. Copilot has a persistent memory feature that stores user information, preferences, and instructions so they don't need to be re-entered in future conversations. The researchers hid prompt-injection text inside a webpage's metadata and induced the user to ask Copilot to summarize that page. Copilot followed the hidden instructions embedded in the page and updated its memory with fabricated content. Varonis noted that this technique could be used to skew output in a specific direction, filter information, bias responses toward an attacker-chosen narrative, or trigger particular actions when certain conditions are met. More seriously, the tampered memory persisted even after a password change, forced session termination, or device re-registration. The only way a user could detect it was by manually reviewing the memory contents entry by entry.

Varonis named the entire attack chain "Co-Snitch." The company had previously demonstrated an attack on Copilot Personal that covertly executed multiple steps from a single click, and back in June it disclosed another one-click exfiltration attack called "SearchLeak."

A recurring pattern of AI agent vulnerabilities

This is not the first time this kind of vulnerability has surfaced. On August 10, white text hidden in a PDF was reportedly enough to breach an Atlassian AI agent. In that case, PromptArmor exfiltrated internal company data from Atlassian's AI agent Rovo using nothing more than white-on-white text hidden inside a PDF — again with no user approval and no trace left in the chat window. On August 13, another case emerged in which the public AI model used in Zoom's screen-share annotation feature was compromised with fewer than 20 input prompts. What all three cases share is that the attack completes with little to no user action — often just a single click.

Editor's take

The most striking part of this case is how the vulnerability was found. The researchers didn't dissect code or reverse-engineer anything. They simply kept asking Copilot why it couldn't do something. Large language models are trained to be helpful, so even when they refuse, they tend to explain why. That explanation itself becomes the blueprint an attacker needs — that's the core of what happened here. A system that defends its safeguards with words can be broken by asking the right words.

Comparing this to traditional software security makes the shift feel different. Classic software vulnerabilities require disassembling binaries and digging through memory structures — work that demands specialized skill and time. But vulnerabilities in AI agents can surface within days of playing twenty-questions in a chat window. The barrier to entry has effectively disappeared, which means the pool of potential attackers has expanded from a handful of specialists to anyone who knows how to use a chatbot.

The practical takeaway is clear. When companies grant AI agents access to email, documents, or memory, that access should be scoped to the minimum necessary, and the number of apps an agent can connect to should be limited to what's actually required for the job. Without regular audits of an agent's conversation logs and memory-change history, companies risk reproducing exactly what happened here — tampered memory surviving even a password change. The old advice to be careful about clicking links now applies not just to phishing emails, but to every webpage an AI assistant opens on your behalf.

Similar cases are likely to surface in other enterprise AI agents in the coming weeks, as security firms like Varonis and PromptArmor apply the same methodology — interrogating agents about how their safeguards work — to other products. If a system builds its safeguards out of conversation rather than code, becoming the next target is only a matter of time.