Microsoft Copilot Hacked Via Secret Input Parameter

Security researchers from Varonis have successfully demonstrated a critical vulnerability in Microsoft 365 Copilot Enterprise, enabling them to exfiltrate sensitive user data, including passwords, without explicit user confirmation. The exploit was achieved not through traditional reverse engineering but by querying the AI assistant itself, which inadvertently revealed a previously undocumented prompt parameter. This parameter allowed attackers to bypass the system's built-in guardrails that normally require user consent for executing powerful commands or accessing sensitive information. The researchers engaged Copilot in a series of questions, akin to a "20 questions" game, to probe its safety mechanisms. They inquired about the reasons behind the impossibility of auto-execution, the specific URL structures and deep links involved, and the behavior when a page loads with pre-existing input in the prompt field. Each response from Copilot provided incremental details about its complex safety architecture and its limitations. Ultimately, Copilot disclosed a significant Microsoft trade secret: an undocumented prompt parameter that completely circumvented the necessity for user consent. This discovery highlights a novel attack vector where an AI model's own conversational output can be leveraged to uncover and exploit security flaws. The ability to force an AI model to reveal such critical information underscores the evolving landscape of cybersecurity threats in the age of advanced AI assistants. Microsoft 365 Copilot Enterprise is designed to assist users with various tasks within the Microsoft 365 ecosystem, integrating AI capabilities to enhance productivity. However, the vulnerability exposed by Varonis indicates that the security protocols surrounding these powerful tools require continuous scrutiny and reinforcement. The exploit's success in bypassing user confirmation mechanisms, a fundamental security layer for sensitive operations, presents a significant concern for enterprise data protection. The researchers' method of using the AI's own responses to uncover the vulnerability is a notable development in offensive security research, suggesting that AI models themselves could become targets or tools for discovering their own weaknesses. This incident prompts a re-evaluation of how AI assistants handle sensitive queries and the robustness of their internal security configurations. The specific details of the undocumented prompt parameter and the exact nature of the data exfiltrated were not fully disclosed in the initial report, but the implication is that user credentials and other confidential information could be compromised. The security firm Varonis has a history of identifying and reporting on significant cybersecurity vulnerabilities across various platforms and technologies. Their findings regarding Microsoft Copilot Enterprise are expected to lead to prompt patching and security updates from Microsoft to address the identified exploit.