Case reprompt-copilotPrompt injectionWorldwide
Reprompt: one-click attack hijacks Microsoft Copilot sessions to steal data
Varonis showed a crafted Microsoft link could pre-fill Copilot prompts via URL parameter and keep exfiltrating a victim's data and memory even after the chat closed.
MediumAttack on AIStatus: PatchedVerified case file
Open in the interactive mapCite this case
- Reported
- Jan 14, 2026
- Location
- Worldwide
- Target
- Microsoft Copilot Personal
- Severity
- Medium
- Triggered by
- Varonis Threat Labs (responsible disclosure)
- Actor type
- Security researchers
- Reported loss
- None reported
- CVE
- None
What happened
Varonis showed a crafted Microsoft link could pre-fill Copilot prompts via URL parameter and keep exfiltrating a victim's data and memory even after the chat closed.
Impact: Proof of concept only; could have exfiltrated personal data and Copilot memory from consumer users. Microsoft 365 Copilot not affected. No victims reported.
Who triggered it
Actor: Varonis Threat Labs (responsible disclosure)
Attribution: Self-disclosed by Varonis; confirmed and patched by Microsoft
Motive: Security research; no exploitation in the wild reported
How it happened
Attack vector: Phishing link to a legitimate copilot.microsoft.com URL whose q parameter auto-executes a prompt, with follow-up instructions fetched from attacker server
Root cause: Copilot Personal auto-ran prompts passed via URL parameter and allowed persistent exfiltration after the chat window closed
Timeline
- Varonis reports the flaw to Microsoft
- Microsoft ships fix in January Patch Tuesday
- Varonis publishes Reprompt research
Response
Microsoft rolled out protections against the scenario and said it is adding defense-in-depth measures; Varonis published guidance.
Current status: Patched
Sources (open in a new tab)
- Varonis varonis.com
- TechRepublic techrepublic.com
- Windows Report windowsreport.com
Cite this case
Reprompt: one-click attack hijacks Microsoft Copilot sessions to steal data. AI Threat Watch, case reprompt-copilot, Jan 14, 2026. https://aithreat.io/cases/reprompt-copilot/
Permanent link: https://aithreat.io/cases/reprompt-copilot/