{"schema_version":"0.10.0","id":"LR-2026-0386","record_version":1,"title":"Reprompt attack enabled single-click data theft from Microsoft Copilot","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":62.7,"score_breakdown":{"source_authority":12.1,"independent_corroboration":20.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":3.0,"completeness":5.44,"unhedged_language":5.0},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true,"record_integrity":true,"eligible":true,"about_this_case":true},"gate_version":"gate-2026-10-18.7","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-11-01","extraction_run_id":null,"evidence_level":{"level":"confirmed","reason":"3 independent outlets","original_document":null,"reports_total":3,"reports_independent":3,"reports_derivative":0,"developing":false,"disputed":false,"rules_version":"evidence-2026-10-29.1","computed_at":"2026-11-01","history":[{"date":"2026-11-01","from_level":null,"to_level":"confirmed","reason":"3 independent outlets"}]},"sources_hash":"e7aad18f050ecec5d60ed9d35cc95a2db7fba6a7a7fe0429be1cd671baf36865"},"system":{"model_name":null,"model_version":null,"developer":"Microsoft","harness":null,"tools_granted":[],"permissions_scope":"access to user-provided prompts, conversation history and certain personal Microsoft data, depending on context and permissions","autonomy_level":"unknown","guardrails_present":[],"deployment_context":"unknown","tier":null,"lifecycle_stage":null,"integration_type":null,"intended_use":"AI assistant for personal accounts, integrated into Windows, Edge and consumer applications","safeguard_state":null,"production_intended":null},"event":{"date_occurred":null,"date_disclosed":"2026-01-14","incident_class":"security_compromise","failure_class":null,"agent_involved":true,"secondary_failure_classes":[],"trigger":"prompt_injection","duration":null,"detection_method":"public_researcher","summary":"Researchers at Varonis identified Reprompt, an attack method that could let an attacker infiltrate a user's Microsoft Copilot session and direct it to exfiltrate sensitive data. Copilot accepted prompts in the 'q' parameter of a legitimate URL and executed them automatically when the page loaded, so a phishing link could start the attack. Copilot's data-leak safeguards applied only to the initial request, and follow-up instructions from an attacker's server kept the exchange going. The researchers disclosed the flaw to Microsoft on August 31, 2025, and Microsoft addressed it. Exploitation was not detected in the wild. Varonis clarified that Reprompt only impacted Copilot Personal, not Microsoft 365 Copilot, which is available to enterprise customers and is better protected by additional security controls, such as Purview auditing, tenant-level DLP, and admin-enforced restrictions.","tags":[],"date_detected":null,"near_miss":null,"root_cause":null,"root_cause_detail":null,"failure_class_detail":null,"responsible_party":"provider","adversarial_actor":null,"input_provenance":"phishing email carrying a legitimate Copilot URL with a malicious q parameter","time_to_contain":null,"operations_paused":null,"remediation":"Microsoft fixed the issue after responsible disclosure","precursor_events":"Responsible disclosure of the flaw to Microsoft on 2025-08-31","primary_risk":"RK04","secondary_risks":["RK03"]},"impact":{"direct_loss_usd":null,"remediation_hours":null,"records_exposed":null,"third_parties_affected_count":null,"severity":"minor","harm_class":[],"affected_description":null,"protected_class_involved":null,"data_categories_exposed":[],"loss_range_usd":null,"reversibility":null,"downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://www.bleepingcomputer.com/news/security/reprompt-attack-let-hackers-hijack-microsoft-copilot-sessions/","publisher":"BleepingComputer","date":"2026-01-14","type":"press","title":"Reprompt attack hijacked Microsoft Copilot sessions for data theft - BleepingComputer","archived_url":null,"attachment":"first_report","independence":"independent"},{"url":"https://cybersecuritynews.com/reprompt-single-click-copilot-exploit/","publisher":"CyberSecurityNews","date":"2026-01-14","type":"press","title":"New One-Click Microsoft Copilot Vulnerability Grants Attackers Undetected Access to Sensitive Data - CyberSecurityNews","archived_url":null,"independence":"independent"},{"url":"https://thehackernews.com/2026/01/researchers-reveal-reprompt-attack.html","publisher":"The Hacker News","date":"2026-01-15","type":"press","title":"Researchers Reveal Reprompt Attack Allowing Single-Click Data Exfiltration From Microsoft Copilot - The Hacker News","archived_url":null,"independence":"independent"}],"per_field_confidence":{"system.developer":"C","system.permissions_scope":"C","system.intended_use":"C","event.incident_class":"C","event.agent_involved":"C","event.trigger":"C","event.detection_method":"C","event.responsible_party":"C","event.input_provenance":"C","event.remediation":"C","event.precursor_events":"C","impact.severity":"D","event.primary_risk":"D","event.secondary_risks":"D","event.summary":"C","system.autonomy_level":"D","system.deployment_context":"D","context.country":"D","event.date_disclosed":"D","context.denominator_available":"D"},"field_citations":{"system.developer":[{"source_index":2,"quote":"Following responsible disclosure, Microsoft has addressed the security issue."}],"system.permissions_scope":[{"source_index":0,"quote":"As such, it can access and reason over user-provided prompts, conversation history, and certain personal Microsoft data, depending on context and permissions."}],"system.intended_use":[{"source_index":0,"quote":"Copilot connects to a personal account and acts as an AI assistant, being integrated into Windows and the Edge browser, as well as various consumer applications."}],"event.incident_class":[{"source_index":0,"quote":"Researchers identified an attack method dubbed “Reprompt” that could allow attackers to infiltrate a user’s Microsoft Copilot session and issue commands to exfiltrate sensitive data."}],"event.agent_involved":[{"source_index":0,"quote":"They found that Copilot accepts prompts via the 'q' parameter in the URL and executes them automatically when the page loads."}],"event.trigger":[{"source_index":0,"quote":"Parameter-to-Prompt (P2P) injection, where the 'q' parameter is used to inject instructions directly into Copilot, potentially stealing user data and stored conversations."}],"event.detection_method":[{"source_index":0,"quote":"Researchers identified an attack method dubbed “Reprompt” that could allow attackers to infiltrate a user’s Microsoft Copilot session and issue commands to exfiltrate sensitive data."}],"event.responsible_party":[{"source_index":2,"quote":"Following responsible disclosure, Microsoft has addressed the security issue."}],"event.input_provenance":[{"source_index":1,"quote":"Attackers initiate Reprompt by sending a phishing email with a legitimate Copilot URL containing a malicious ‘q’ parameter, which auto-executes a prompt upon page load."}],"event.remediation":[{"source_index":0,"quote":"The researchers disclosed Reprompt responsibly to Microsoft last year on August 31, and the issue received a fix today."}],"event.precursor_events":[{"source_index":1,"quote":"Varonis responsibly disclosed the issue to Microsoft on August 31, 2025, with a fix deployed via the January 13, 2026, Patch Tuesday."}],"impact.severity":[{"source_index":0,"quote":"While exploitation of the Reprompt method has not been detected in the wild and the problem has been addressed, it is highly recommended to apply the latest Windows security update as soon as possible."}],"event.summary":[{"source_index":0,"quote":"Researchers identified an attack method dubbed “Reprompt” that could allow attackers to infiltrate a user’s Microsoft Copilot session and issue commands to exfiltrate sensitive data."},{"source_index":0,"quote":"They found that Copilot accepts prompts via the 'q' parameter in the URL and executes them automatically when the page loads."},{"source_index":1,"quote":"Attackers initiate Reprompt by sending a phishing email with a legitimate Copilot URL containing a malicious ‘q’ parameter, which auto-executes a prompt upon page load."},{"source_index":0,"quote":"Double-request technique, which exploits the fact that Copilot's data-leak safeguards apply only to the initial request."},{"source_index":0,"quote":"Chain-request technique, where Copilot continues to receive instructions dynamically from the attacker's server."},{"source_index":1,"quote":"Varonis responsibly disclosed the issue to Microsoft on August 31, 2025, with a fix deployed via the January 13, 2026, Patch Tuesday."},{"source_index":2,"quote":"Following responsible disclosure, Microsoft has addressed the security issue."},{"source_index":0,"quote":"While exploitation of the Reprompt method has not been detected in the wild and the problem has been addressed, it is highly recommended to apply the latest Windows security update as soon as possible."},{"source_index":0,"quote":"Varonis clarified that Reprompt only impacted Copilot Personal, not Microsoft 365 Copilot, which is available to enterprise customers and is better protected by additional security controls, such as Purview auditing, tenant-level DLP, and admin-enforced restrictions."}]},"notes_on_gaps":"Sources do not state the Copilot model name, version, harness, autonomy level, lifecycle stage, deployment country or industry, so those fields are omitted. No occurrence date is given because the attack was not seen in the wild; date_disclosed uses the 2026-01-14 article date as a proxy and date_detected is omitted. Sources conflict on the fix date: Source 1 says Patch Tuesday, Source 0 later corrects that it was fixed separately; the exact fix date is not stated. The fix's technical content is not described, so the C1 mapping on the fix remediation is my judgement, inferred from the stated prompt-handling failure. Control outcomes and the C4 mapping for data-leak safeguards are my judgement from the quoted sentences. I treated Copilot as an agent involved because it executes actions on the user's behalf; this is a judgement. Severity is minor because the sources state no exploitation and no third party touched. Duration, time to contain, records exposed, direct loss, affected party counts and remediation hours are not stated. The adversarial actor is omitted because no real attacker is described; the attack was demonstrated by researchers. [case created by the backfill: read by claude-haiku-5-5, backfill-2026-11-01.2, 2026-11-01; not yet reviewed] [2026-11-01: evidence level set: Confirmed (3 independent outlets)]"},"context":{"industry":null,"org_size_band":null,"country":"unknown","denominator_available":false,"denominator":null,"related_incident_ids":[],"systemic_exposure":null,"shared_model_id":null,"upstream_incident_id":null,"incident_evidence":null,"regulatory":null,"coverage":null},"narrative":{"steps":[{"step":"doing","text":"Copilot runs prompts passed in a URL's q parameter as soon as the page loads.","quote":"They found that Copilot accepts prompts via the 'q' parameter in the URL and executes them automatically when the page loads.","source_index":0,"grade":"C"},{"step":"reached","text":"The attack starts with a phishing email carrying a legitimate Copilot link.","quote":"Attackers initiate Reprompt by sending a phishing email with a legitimate Copilot URL containing a malicious ‘q’ parameter, which auto-executes a prompt upon page load.","source_index":1,"grade":"C"},{"step":"caught","text":"Varonis security researchers identified the method and reported it.","quote":"Researchers identified an attack method dubbed “Reprompt” that could allow attackers to infiltrate a user’s Microsoft Copilot session and issue commands to exfiltrate sensitive data.","source_index":0,"grade":"C"},{"step":"done","text":"Microsoft addressed the issue after responsible disclosure.","quote":"The researchers disclosed Reprompt responsibly to Microsoft last year on August 31, and the issue received a fix today.","source_index":0,"grade":"C"}],"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://www.bleepingcomputer.com/news/security/reprompt-attack-let-hackers-hijack-microsoft-copilot-sessions/","https://cybersecuritynews.com/reprompt-single-click-copilot-exploit/","https://thehackernews.com/2026/01/researchers-reveal-reprompt-attack.html"]},"analysis":{"sections":{"timeline":[{"text":"Varonis responsibly disclosed the issue to Microsoft.","quote":"Varonis responsibly disclosed the issue to Microsoft on August 31, 2025, with a fix deployed via the January 13, 2026, Patch Tuesday.","source_index":1,"when":"2025-08-31"}]},"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://www.bleepingcomputer.com/news/security/reprompt-attack-let-hackers-hijack-microsoft-copilot-sessions/","https://cybersecuritynews.com/reprompt-single-click-copilot-exploit/","https://thehackernews.com/2026/01/researchers-reveal-reprompt-attack.html"]}}