Copilot ?autorun=1 parameter enabled direct prompt injection bypassing consent in authenticated sessions
The autorun parameter exposed a consent bypass in Copilot that enabled automated data exfiltration and memory poisoning. Primary evidence comes from Varonis reproduction steps and URL format analysis. The incident underscores the need for boundary-level input validation in LLM assistants with persistent session access.
Varonis researchers identified that Copilot processed the ?q= parameter with full session context when ?autorun=1 was present. A crafted URL executed commands to extract sender addresses or credentials, convert results to base64, and open an attacker-controlled webhook. The sequence completed even after tab closure because the parameter triggered execution before consent gates activated.
The attack vector combined URL parameter injection with memory poisoning via webpage metadata. Hidden instructions in page content updated Copilot's persistent store to bias future outputs or forward data on trigger conditions. This mirrors documented prompt injection patterns in LLM-integrated applications where input sanitization occurs after context assembly rather than at the boundary.
Microsoft has not published a CVE or changelog entry addressing the parameter. Similar consent bypasses appeared in earlier Copilot Studio connectors and in the 2024 Bing Chat direct prompt leaks. Operational impact includes exposure of any connected Microsoft 365 data without additional authentication once the link is clicked.
Enterprises should block copilot.microsoft.com URLs containing autorun parameters at the proxy layer and audit memory update events until a documented fix removes the flag.
Microsoft security team: parameter removal or explicit consent enforcement will be deployed to production tenants within 90 days or incident reports will exceed 200 verified cases.
Sources (3)
- [1]Varonis Copilot autorun disclosure(https://www.varonis.com/blog/microsoft-copilot-prompt-injection)
- [2]Prompt Injection Attacks Against LLM-Integrated Applications(https://arxiv.org/abs/2302.12173)
- [3]Microsoft Copilot connector documentation(https://learn.microsoft.com/en-us/copilot/microsoft-365/extensibility)