Cases › security breach › LR-2026-0384
Reprompt: a single malicious Copilot link could expose user data
Preliminary Why: 1 report: Fox News · subject to change · 1 independent report
Status: fix reported
No source states: loss or records, agent tool, could do, deployer, industry.
Microsoft Copilot, an AI assistant that can write emails, summarize documents and answer questions using information from a user's account, was the subject of a technique security researchers at Varonis called Reprompt. Attackers could hide instructions in a Copilot link so that, after one click, Copilot would process them and act on the user's behalf, including sending data out piece by piece through an attacker-controlled server. The researchers said Reprompt got around some of Copilot's data-leak protections. Varonis reported the issue to Microsoft, which fixed it in the January 2026 Patch Tuesday updates. The source states there is no evidence Reprompt was used in real-world attacks before the fix, and that the issue affected only Copilot Personal.
What happened
What was done
“Microsoft fixed the issue in the January 2026 Patch Tuesday updates”
Vulnerability scanning of AI components
Same developer, same risk, after the fix: LR-2026-0305 · LR-2026-0580
Risks
Primary50 incidents
Rising: 6 vs 2.8 a week
Read from the sources; not yet reviewed by a person.
Controls
HarnessNot effective Outside content treated as data, not instructions
Control failure chain
L1 · ModelMicrosoftModel provider
No source mentions a control at this layer.
Model version not linked to a model card.
L2 · HarnessHarness not namedAgent framework vendor
Other controls for this risk at this layer, not mentioned in the sources: Prompt-injection detection, Confirmation after untrusted input, Validation of tool inputs and outputs, Tool allow-list.
L3 · ApplicationDeployer not namedDeployer
No source mentions a control at this layer.
Other controls for this risk at this layer, not mentioned in the sources: Human approval for high-impact actions, Least-privilege access for the agent, Segmentation of agent components, Alerts on unusual tool use.
L4 · Infrastructure / targetOrganisation hit
No source mentions a control at this layer.
EffectiveNot effectiveNot effective (bypassed)Did not existNot stated in sourcesNot yet checkedAttacker's ownOrder: model · harness · application · target
Controls for this risk: result in this incident
| Control | Part of the system | Result |
|---|---|---|
| Outside content treated as data, not instructions | L2 Harness | Not effective |
| Tool allow-list | L2 Harness | Not stated in sources |
| Confirmation after untrusted input | L2 Harness | Not stated in sources |
| Prompt-injection detection | L2 Harness | Not stated in sources |
| Validation of tool inputs and outputs | L2 Harness | Not stated in sources |
| Least-privilege access for the agent | L3 Application | Not stated in sources |
| Human approval for high-impact actions | L3 Application | Not stated in sources |
| Segmentation of agent components | L3 Application | Not stated in sources |
| Alerts on unusual tool use | L3 Application | Not stated in sources |
Similar incidents
Evidence
- What set it off hidden instructions in its input
No source states: what went wrong, what it reached or did, when it happened, when it was found, how many records were exposed, the direct loss, a count of the other parties affected, any court case, the cause.
Show the full account: 3 items from the primary sources
What happened, in order
- January 2026 Microsoft fixed the issue in the January 2026 Patch Tuesday updates.
Not dated in the sources:
- Varonis reported the issue to Microsoft.
- No evidence that Reprompt was used in real-world attacks before the fix.
Show every field, with its source and grade
The AI system
What happened
Impact
Notes on gaps
Date of occurrence not stated; the article date 2026-01-24 was not used as a disclosure date because the source does not state when the issue was disclosed. Attacker identity is not stated: the source describes what attackers could do, not a real attacker.
LR-2026-0384 · version 1 · published 2026-11-01 after automatic checks; not yet checked field by field by a person · JSON