AI NEWSLatest AI NewsArticleMicrosoft Copilot Vulnerability: Malicious Links Bypass Confirmation and Automatically Steal Emails and CredentialsPublished in Latest AI NewsTime :Aug 19, 2026Read :3minuteTechnology media Ars Technica reported on August 18 that security company Varonis discovered a security vulnerability in Microsoft Copilot. Attackers can exploit the?autorun=1parameter combined with?q=to bypass user confirmation and directly steal information. Similar to most AI assistants, Copilot supports receiving prompts via URL. The basic part can trigger applications like Gmail, while subsequent parameters can request summarizing the inbox or drafting emails.Five-step attack chain, data transmitted using Base64Researchers created a link likehttps://copilot.microsoft.com/?q=&autorun=1: when users click it, Copilot loads in the already logged-in session, andautorun=1triggers automatic execution, allowing the prompt in?q=to run without any gestures. The injected instructions can search the inbox, extract sender addresses or password credentials, store them in variables, and then send them to a webhook URL controlled by attackers, which is automatically opened, leading to the leakage of sensitive data.To hide their tracks, the transmitted content is first converted into Base64. The complete attack chain consists of five steps: the victim clicks on a carefully constructed link → Copilot loads in the authenticated session → the parameter triggers automatic execution → Copilot gains full access to the session context, connected applications, and memory → even if the tab is closed immediately, the prompt will still be executed, including online retrieval and multi-turn chain operations. This vulnerability warns that once an AI assistant is integrated with a private account, a “single-link” can turn into a privacy backdoor.