Security researchers tricked Microsoft Copilot into revealing a secret URL parameter (?autorun=1) that let malicious links make it run commands with zero user confirmation — just one click. Using this, they got Copilot to search victims’ inboxes for passwords and send them to an attacker-controlled server, and also planted false “memories” in Copilot via hidden text on webpages. Microsoft has patched the issue, but the case shows how fragile AI assistants’ safety guardrails can be.
Tldr:
Security researchers tricked Microsoft Copilot into revealing a secret URL parameter (
?autorun=1) that let malicious links make it run commands with zero user confirmation — just one click. Using this, they got Copilot to search victims’ inboxes for passwords and send them to an attacker-controlled server, and also planted false “memories” in Copilot via hidden text on webpages. Microsoft has patched the issue, but the case shows how fragile AI assistants’ safety guardrails can be.