Security firm Varonis has disclosed a one-click attack against Microsoft 365 Copilot Enterprise that exfiltrates sensitive user data, including passwords, to an attacker-controlled server. The striking detail: the researchers found the critical vulnerability not through reverse engineering but by asking Copilot itself.

Senior researcher Lior Adar and his team questioned the assistant about its guardrails, which normally require an explicit user gesture before executing powerful commands. Each refusal revealed architectural details. Eventually Copilot disclosed an undocumented prompt parameter, ?autorun=1, that bypasses the consent requirement entirely. Combined with the known ?q= parameter, which injects text into the chatbot input, a crafted URL such as https://copilot.microsoft.com/?q=...&autorun=1 fired the embedded prompt the moment a victim clicked the link.

One demonstrated prompt instructed Copilot to find the latest inbox sender, store the address in a variable, and append it to an attacker URL. Another searched the mailbox for passwords and leaked any findings. Stolen data was base64-encoded and transmitted by automatically opening an attacker-hosted page. The prompt executed to completion even if the Copilot tab was closed immediately after loading, with full access to the victim's session, connected apps, and memory.

Varonis also showed a second attack that poisons Copilot's permanent memory via prompt injection hidden in webpage metadata. When a user asked Copilot to summarize the page, the assistant wrote attacker instructions into memory, where they persisted across password changes, session revocations, and device re-enrollments. Detection would require manually inspecting memory contents.

Microsoft applied a silent partial fix in February, three months after Varonis reported the issue, by blocking ?q= from injecting text, which also broke legitimate third-party browser integrations. More comprehensive fixes shipped on Tuesday. Varonis names the attack family Co-Snitch; it follows the firm's earlier one-click attacks against Copilot Personal and the SearchLeak exfiltration technique demonstrated in June. The researchers' broader point: LLM security still rests on reactive guardrails that fail under pressure, rather than architectures that prevent misuse by design.