Vulnerability / research

Reprompt turned a Copilot link into a data-exfiltration chain

Reported

What happened

Varonis demonstrated a crafted link that caused Copilot Personal to execute attacker-directed follow-up requests and disclose information from the user's session.

Parties and reporting

AI tools and systems: Microsoft Copilot Personal

Outcome

Microsoft patched the issue. Varonis stated that Microsoft 365 Copilot enterprise customers were not affected by this finding.

Operating lesson

Validate externally supplied prompts and keep data-transfer protections active throughout chained requests.

Evidence and limits

Controlled demonstration; no real-world victim count is established. Original publication date is verified in page metadata despite a June update.

Sources