Microsoft copilot AI vulnerability allows data theft via malicious links

A security researcher from Varonis has uncovered a critical vulnerability in Microsoft Copilot, an AI assistant integrated into Microsoft products. The flaw allows attackers to bypass user confirmation prompts by using specific URL parameters, enabling the unauthorized extraction of sensitive information. The vulnerability can be exploited by crafting malicious links that include the ?autorun=1 parameter alongside a ?q= query. When a user clicks on such a link, the browser loads Copilot in an already authenticated session, triggering the automatic execution of the embedded prompt without any user interaction. The malicious prompt can instruct Copilot to search through the user's inbox, extract email addresses, and store them in a variable. It then generates a new URL and executes a command to summarize it, effectively sending the stolen data to an attacker-controlled server. The researchers also demonstrated a second prompt that instructs Copilot to search for passwords and other credentials, which are then encoded in Base64 and transmitted to the same server. The attack can be delivered through various means, including email, chat messages, phishing pages, or QR codes. Once the malicious link is clicked, the attacker can access the victim's data without further user action, even if the Copilot tab is closed immediately after loading. The vulnerability highlights the risks associated with AI assistants that can be manipulated through URL parameters, raising concerns about data privacy and security in AI-driven platforms.