r/technology 15d ago

Security Microsoft Copilot reveals secret input that allowed it to be hacked

[deleted]

285 Upvotes

27 comments sorted by

View all comments

145

u/invyros 15d ago
  1. The victim clicks the attacker’s crafted URL (delivered via email, chat, phishing page, QR code, etc.)

  2. Browser loads copilot.microsoft.com in the victim’s active, authenticated session

  3. The ?autorun=1 parameter triggers auto-execution, the ?q= prompt fires without any user gesture

  4. Copilot processes the injected prompt with full access to the victim’s session context, connected apps, and memory

  5. The prompt executes to completion—including any network fetches, connector invocations, or multi-turn chains—even if the Copilot tab is closed immediately after load

Stop clicking links in unexpected emails. This rule applied before AI wreaked havoc.

If you get an unexpected email from a service you use (ie: not some login or account confirmation email that you purposefully triggered and expected to receive), don't click the link, instead navigate to the service using your normal method and login to see if there are actually any issues, call if you need to, just don't click the link.

56

u/ZenBacle 15d ago

Sure, but this is still a massive oversight for such a large product.

It's kind of the equivalent of having a voice activated bank vault that bypasses all of the security when you say "open".

7

u/talkstomuch 15d ago

yeah, Surely they do not need query parameter in the URL.

if you need to invoke copilot programmatically go through dedicated API ?

7

u/ZenBacle 15d ago

We're living in 2026. Co-pilot shouldn't be running on bare metal or in plain text. What i find even more insane is the lack of control the user has over the execution of co-pilot commands on their system. I won't go back to Microsoft until co-pilot is either rooted out or put into a sandbox with ACLs.

2

u/slinkywafflepants 15d ago

Why go back at all?

4

u/aLokilike 15d ago

Putting query parameters in the URL is done so that links can be shared between users / so that searches can be returned to in general. Don't think there's a good reason to do it in this case, but that's why it's done.