Reprompt attack bypassed Microsoft Copilot security via URL parameter
Researchers discovered Reprompt, a vulnerability in Microsoft Copilot Personal that allowed attackers to steal user data through a single malicious link by exploiting URL parameter injection. Microsoft confirmed the issue was patched on June 15, 2026.
What happened
Varonis Threat Labs discovered an attack called Reprompt affecting Microsoft Copilot Personal that allowed attackers to steal user data with a single click on a malicious link. The attack exploited the 'q' URL parameter to inject prompts and bypass Copilot's security guardrails, enabling threat actors to extract personally identifiable information and other sensitive data from users' chat histories and file access records.
The attack combined three techniques: Parameter 2 Prompt (P2P) injection through the URL parameter, a double-request method to force Copilot to perform actions despite safeguards, and chain requests for follow-up data exfiltration. Attackers maintained control even after the Copilot chat window was closed, silently exfiltrating the victim's session without further interaction.
Reported impact
The attack bypassed enterprise security controls entirely and could not be detected by client-side monitoring tools. Attackers could request sensitive information such as file summaries, location data, and personal calendar details from compromised users.
Index analysis
The vulnerability affected the handling of URL parameters in Copilot's prompt processing, allowing arbitrary instruction injection. Copilot's safeguards against direct data exfiltration could be circumvented by repeating requests twice and using chained server-side commands.
Governance controls
Microsoft confirmed the issue was patched as of June 15, 2026. Enterprise customers using Microsoft 365 Copilot were not affected by the vulnerability.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.