Microsoft Copilot URL Prompt Injection Attacks Could Expose Sensitive Data

Like many AI assistants, Microsoft Copilot can process prompts embedded in URLs. The base URL directs the large language model (LLM) to services such as Gmail, while parameters and text appended to the URL can instruct Copilot to summarize an inbox, search for messages, or draft a new email. However, these actions should only be performed with the user’s knowledge and approval.

According to security researchers at Varonis, undocumented Copilot URL parameters could be abused to bypass certain protections and inject prompts directly into the assistant. This technique could allow an attacker to send a specially crafted link through email, text messages, chat platforms, QR codes, or phishing pages.

How the Copilot URL Attack Works

In one example, a malicious prompt instructed Copilot to search the victim’s inbox, identify the most recent sender, extract the sender’s email address, and store it in a variable. Copilot was then directed to create a URL that summarized or transmitted the collected information.

The resulting link could be sent to a victim. When clicked, it could cause sensitive information to be sent to a server controlled by the attacker. A similar prompt could instruct Copilot to search the inbox for passwords, credentials, or other confidential data. If such information was discovered, it could also be transmitted externally.

To conceal the stolen information and reduce the risk of transmission errors, the data could be encoded in Base64 before being added to another URL. Copilot could then automatically open that URL on the victim’s device, directing the information to an attacker-controlled website.

Attack Chain Identified by Varonis

Varonis described the attack sequence as follows:

1. The victim clicks a URL created by the attacker and delivered through email, chat, a phishing page, or a QR code.
2. The browser opens copilot.microsoft.com within the victim’s active, authenticated session.
3. URL parameters trigger Copilot to run automatically and process the embedded prompt without an additional user gesture.
4. Copilot uses the victim’s available session context, connected applications, and stored memory to process the injected instructions.
5. The prompts may continue running after the Copilot tab is closed, including network requests, connector calls, and multi-step AI interactions.

Copilot Persistent Memory Security Risk

Varonis also demonstrated a separate prompt injection technique involving Copilot’s persistent memory. This feature stores user information, preferences, settings, and instructions so they can be used in future conversations without requiring the user to provide them again.

In the demonstration, a malicious instruction hidden in a webpage’s metadata was processed when the user asked Copilot to summarize the page. The instruction caused the assistant to modify its persistent memory without the user’s clear awareness.

Researchers warned that attackers could potentially use poisoned memory to redirect Copilot’s future responses, suppress selected information, promote an attacker-controlled narrative, or trigger predefined actions when certain conditions are met.

Why Prompt Injection Remains a Concern

These findings highlight the security challenges created when AI assistants can access email accounts, connected applications, browsing sessions, and persistent user data. URL-based prompt injection and memory poisoning can turn seemingly harmless links or webpages into mechanisms for data theft and unauthorized actions.

Users should avoid clicking suspicious Copilot links, review connected applications and memory settings, and verify AI-generated actions before allowing them to access or share sensitive information. Organizations should also consider restricting automated AI actions and monitoring unusual activity involving email, connectors, and external URLs.

Source: arstechnica.com