Microsoft 365 Copilot Disclosed a Hidden Parameter That Enabled an Attack

Researchers found a critical weakness in Microsoft 365 Copilot for enterprise by getting the AI assistant to explain its own safety controls. The information eventually allowed them to bypass a user-consent requirement and create an exploit capable of exposing passwords and other sensitive data after a user clicked a link.

The unusual part of the discovery was not only what the vulnerability made possible, but how it was uncovered. Instead of relying primarily on conventional reverse engineering, researchers at security firm Varonis repeatedly questioned Copilot about the guardrails designed to prevent automatic execution of sensitive commands. Copilot’s answers ultimately revealed an undocumented prompt parameter that bypassed those protections.

The researchers wanted a low-interaction exploit

Varonis began with a specific objective: develop an exploit that could exfiltrate user data when the target did nothing more than click a link. The researchers did not want the attack to depend on the user typing a command, pressing the return key, or taking another explicit action after opening the link.

Copilot initially resisted that behavior. Like many current AI assistants, it required clear user consent before carrying out powerful or sensitive instructions. That consent had to take the form of a user gesture, such as pressing a key.

This restriction presented an obstacle to the researchers’ intended attack. A link could potentially load a page or place text into an interface, but the assistant’s safeguards were supposed to prevent that preloaded input from running automatically.

The important security boundary therefore rested on the distinction between two events:

• Content appearing in Copilot’s prompt field automatically
• A user deliberately submitting that content through a gesture

Varonis focused its questions on how Copilot recognized and enforced that boundary.

Copilot explained its own guardrails

Rather than stopping after Copilot refused the initial request, the researchers approached the assistant with a sequence of narrower questions. The exchange resembled a game of 20 questions, with each response exposing another part of the safety mechanism.

The researchers asked why automatic execution was not possible and explored the technical conditions involved. Their questions covered areas such as:

• The URL structures connected to Copilot actions
• The role of deep links
• What happens when a page opens with content already placed in the prompt field
• Why a user gesture is required before a sensitive command can run

Individually, the answers did not necessarily provide the complete route around the protection. Together, however, they gave the researchers a progressively clearer picture of how the consent requirement worked and where its limits were.

This method differed from traditional vulnerability research in a significant way. The system being examined also served as a source of technical information about its own internal controls. Copilot’s responses helped the researchers decide what to investigate next until they reached the detail that made the exploit possible.

An undocumented parameter bypassed consent

The questioning eventually led Copilot to reveal an undocumented prompt parameter. Ars described the parameter as a Microsoft trade secret. Its security significance was substantial because it could completely bypass the requirement for an explicit user gesture.

That requirement had been the main safeguard preventing preloaded instructions from executing automatically. Once the researchers knew about the hidden parameter, they could overcome the barrier that Copilot had initially said was mandatory.

The resulting attack combined several elements:

1. A target clicked a specially constructed link.
2. Input could be loaded without the target manually entering it.
3. The undocumented parameter bypassed the normal confirmation requirement.
4. Commands could execute without the expected additional user action.
5. Sensitive information, including user passwords, could be exposed.

The exploit is notable because clicking a link is common user behavior. The safety model was designed to ensure that opening content alone would not count as authorization to execute a powerful command. The hidden parameter undermined that assumption.

The discovery exposes a broader AI security problem

The case shows that an AI assistant’s knowledge of its own safety systems can become a security risk. Copilot did not immediately provide the researchers with a complete exploit. Instead, it disclosed pieces of information over an extended conversation, allowing those pieces to be assembled into an effective bypass.

The incident also demonstrates why a refusal at the start of a conversation does not necessarily prevent sensitive information from emerging later. Copilot rejected the direct attempt to automate execution, yet continued answering related questions about URLs, deep links, prompt behavior, and consent controls.

Several characteristics made the research approach effective:

• The questions were incremental rather than a single direct request.
• Each answer informed the next question.
• The researchers concentrated on the design and limits of a specific guardrail.
• The assistant disclosed a nonpublic implementation detail relevant to bypassing that guardrail.

This creates a distinct challenge for AI products. A model may be prevented from performing a dangerous action directly while still being willing to explain enough about the surrounding system for someone else to defeat its restrictions.

Conclusion

Varonis researchers demonstrated that Microsoft 365 Copilot’s own responses could help uncover a critical vulnerability. By methodically questioning the assistant about its user-consent controls, they learned of an undocumented parameter that allowed those controls to be bypassed. The discovery enabled an attack in which a link click could lead to the exposure of passwords and other sensitive data without further user confirmation.

The episode illustrates that AI security depends not only on blocking prohibited actions, but also on controlling what assistants reveal about the mechanisms intended to keep those actions from occurring.

Original reporting: Ars

---

Originally reported by Ars.