Microsoft Copilot Reveals Secret Input that Allowed it to be Hacked

2026-08-19

Varonis found that Copilot disclosed an undocumented ?autorun=1 URL parameter through repeated questioning. Combined with ?q=, it ran injected prompts after a victim clicked a link. Prompts could search authenticated inboxes and send extracted email addresses or credentials to attacker-controlled servers. Microsoft blocked ?q= input injection in February and issued broader fixes as CVE-2026-24301.