Varonis researchers expose security flaw in Microsoft 365 Copilot via hidden parameter

Varonis security researchers discovered a way to bypass Microsoft 365 Copilot’s organizational safeguards without reverse-engineering, simply by questioning the chatbot itself. The team asked the model to craft an exploit that would exfiltrate user data when a victim clicked a link. Copilot initially refused, explaining that sensitive actions required explicit user approval, such as pressing Enter or a comparable gesture. In response, the researchers probed the model about the same safeguards—why automatic execution was impossible, which URL structures and deep links were involved, and what occurred when a page loaded with input already present in the prompt field. Each refusal revealed additional technical detail about the internal architecture.

During the exchange, Copilot emitted an undocumented parameter, the string `?autorun=1`. Combined with the known `?q=` parameter that injects text into the chat field, the exploit executed automatically as soon as the victim clicked the link, without any further interaction. Lior Adar, a senior researcher at Varonis, told Ars Technica that “with every refusal the model exposed another detail about the internal mechanism, until the hidden parameter was fully revealed.”

Microsoft received the report and patched the vulnerability quietly in February, three months after the disclosure, by blocking `?q=` from injecting text into the input field. Users now must click and type manually, preventing third-party browser integrations from using the parameter as originally intended. On Tuesday the company released broader fixes that close the attack vector completely.

The incident shows how large language models can become tools for uncovering their own implementation flaws, leaking internal logic when subjected to systematic interrogation. For organizations that rely on Copilot as an enterprise assistant, the episode serves as a reminder that user-approval mechanisms are not impervious when the model itself discloses the underlying logic.