Microsoft Copilot reveals secret input that enabled its hack
copilot microsoft
| Source: Ars Technica | Original article
Microsoft Copilot disclosed a hidden parameter that hackers exploited to steal passwords when users clicked a malicious link, prompting the company to quietly address the flaw.
Microsoft has confirmed that a hidden input parameter in its Copilot AI assistant could be weaponised to steal user passwords. The flaw, identified by security‑research firm Varonis, allowed an attacker to append a “?q=” query string to a URL that fed arbitrary text into Copilot’s prompt processing engine. When a victim clicked the malicious link, the injected prompt triggered a password‑capture flow, handing the attacker the user’s credentials.
The vulnerability was silently patched in February after Microsoft ceased accepting the “?q=” injection, effectively closing the attack vector. Varonis first reported the issue three months earlier, prompting a quiet remediation rather than a public advisory. The episode underscores how seemingly innocuous URL parameters can become covert channels for prompt‑injection attacks, a risk that has already surfaced in other Copilot‑related incidents.
Why it matters is twofold. First, the exploit demonstrates that Copilot can be leveraged as a phishing conduit, expanding the attack surface beyond traditional email or web forms. Second, the hidden nature of the parameter raises concerns about the transparency of AI‑driven products that process user‑generated content, especially for enterprise customers handling sensitive data. The incident adds to a string of recent Copilot security setbacks, including the August 17 breach of a GitHub Copilot‑generated “Autofix” that compromised Snowflake’s Jira, which we covered in our earlier reporting.
Looking ahead, analysts will be watching how Microsoft communicates the remediation and whether independent audits will uncover additional latent inputs. Varonis may publish a deeper technical analysis, and security teams are likely to scrutinise other URL‑based prompt mechanisms across Microsoft’s AI stack. The broader industry will also gauge how quickly AI providers can detect and patch such covert channels before they are weaponised at scale.
Sources
Back to AIPULSEN