Microsoft Copilot Flaw Lets Hackers Steal Emails with a Single Link
Imagine clicking a link and, without any warning, your email inbox is silently siphoned off to a stranger. That's the alarming scenario security firm Varonis recently demonstrated with Microsoft's AI assistant, Copilot. On August 18, Ars Technica reported on this vulnerability, which could let attackers bypass user confirmation and swipe sensitive data with a single, carefully crafted URL.
At the heart of the issue is a feature that lets Copilot accept prompts via URL parameters. Most AI assistants, including Copilot, can be triggered by links—think of clicking a link that opens Gmail with a pre-filled email. But Copilot goes further: it can also process commands like "summarize my inbox" or "draft a reply" just by appending parameters to the URL. The problem? One of those parameters, autorun=1, tells Copilot to execute the prompt automatically, with no user interaction required.
Researchers at Varonis built a proof-of-concept link that looks innocuous: https://copilot.microsoft.com/?q=&autorun=1. When a logged-in user clicks it, Copilot loads in their authenticated session, and autorun=1 kicks in, running whatever prompt is in the q parameter. The injected instructions can search the user's inbox, extract sender addresses or even password credentials, store them in variables, and then send them to a webhook URL controlled by the attacker. The link automatically opens that URL, and the data is gone.
To cover their tracks, the attackers encode the stolen data in Base64, making it harder to detect in network logs. The whole attack chain unfolds in five steps: the victim clicks the malicious link → Copilot loads in the authenticated session → the autorun parameter triggers automatic execution → Copilot gains full access to the session context, connected apps, and even memory → and even if the user closes the tab immediately, the prompt still runs, including online retrieval and multi-step operations.
This vulnerability is a stark reminder of the risks that come with integrating AI assistants into our personal accounts. Once an AI has access to your email, calendar, or files, a single link can turn into a privacy backdoor. The researchers emphasize that users should be cautious about clicking links, even those that seem to come from trusted sources, and that AI providers need to implement stricter safeguards to prevent such automatic execution.
While Microsoft has not yet issued a public response, the discovery underscores the importance of security in the rapidly evolving AI landscape. As AI assistants become more deeply embedded in our digital lives, the potential for exploitation grows. For now, the best defense is vigilance: think twice before clicking that link, and consider disabling auto-run features if possible.
Key Points
- Vulnerability discovered: Varonis found a flaw in Microsoft Copilot that allows attackers to bypass user confirmation.
- Attack vector: Malicious links with
?autorun=1and?q=parameters trigger automatic execution of prompts. - Data theft: The attack can steal emails, sender addresses, and credentials, sending them to attacker-controlled webhooks.
- Stealth technique: Stolen data is encoded in Base64 to evade detection.
- Five-step chain: The attack unfolds in a series of steps, from link click to data exfiltration.
- Implications: Highlights the security risks of AI assistants with access to personal accounts.