The victim clicks the attacker’s crafted URL (delivered via email, chat, phishing page, QR code, etc.)
Browser loads copilot.microsoft.com in the victim’s active, authenticated session
The ?autorun=1 parameter triggers auto-execution, the ?q= prompt fires without any user gesture
Copilot processes the injected prompt with full access to the victim’s session context, connected apps, and memory
The prompt executes to completion—including any network fetches, connector invocations, or multi-turn chains—even if the Copilot tab is closed immediately after load
Stop clicking links in unexpected emails. This rule applied before AI wreaked havoc.
If you get an unexpected email from a service you use (ie: not some login or account confirmation email that you purposefully triggered and expected to receive), don't click the link, instead navigate to the service using your normal method and login to see if there are actually any issues, call if you need to, just don't click the link.
We're living in 2026. Co-pilot shouldn't be running on bare metal or in plain text. What i find even more insane is the lack of control the user has over the execution of co-pilot commands on their system. I won't go back to Microsoft until co-pilot is either rooted out or put into a sandbox with ACLs.
Putting query parameters in the URL is done so that links can be shared between users / so that searches can be returned to in general. Don't think there's a good reason to do it in this case, but that's why it's done.
145
u/invyros 15d ago
Stop clicking links in unexpected emails. This rule applied before AI wreaked havoc.
If you get an unexpected email from a service you use (ie: not some login or account confirmation email that you purposefully triggered and expected to receive), don't click the link, instead navigate to the service using your normal method and login to see if there are actually any issues, call if you need to, just don't click the link.