Microsoft 365 Copilot revealed the undocumented parameter that allowed security researchers to force it to steal user passwords — and it revealed that parameter itself, during a conversation in which the assistant gradually described its own guardrails until it handed over the keys.
Researchers at security firm Varonis set out to build an exploit that would exfiltrate user data when a target did nothing more than click a link. Copilot initially refused, insisting that sensitive operations require explicit user consent. Instead of reverse engineering, the team played a game of 20 questions: why was auto-execution impossible, which URL structures and deep links were involved, what happens when a page loads with input already in the prompt field.
Each answer leaked technical details about the safety mechanism's design. Eventually Copilot disclosed an undocumented prompt parameter — what the researchers described as a Microsoft trade secret — that completely bypassed the user-consent requirement. With it, a crafted copilot.microsoft.com link carrying the parameter could fire a prompt in the victim's own authenticated session, with no confirming gesture, and run to completion even if the tab was closed immediately.
The team demonstrated stealing the latest email sender from an inbox and hunting for credentials, exfiltrating results in base64 to an attacker-controlled server. Varonis also showed a second attack that poisoned Copilot's persistent memory through hidden webpage instructions — a compromise that would survive password changes and session revocations.
"At the beginning, Copilot kept refusing, but every refusal revealed technical details about its internal architecture," senior researcher Lior Adar said.
