AI Risk Wire

Cases › security breach › LR-2026-0386

Reprompt attack enabled single-click data theft from Microsoft Copilot

Confirmed Why: 3 independent outlets · 3 independent reports

Status: fix reported

Severity minor
Reported 14 Jan 2026
Developer and model Microsoft

No source states: loss or records, agent tool, could do, deployer, industry.

Researchers at Varonis identified Reprompt, an attack method that could let an attacker infiltrate a user's Microsoft Copilot session and direct it to exfiltrate sensitive data. Copilot accepted prompts in the 'q' parameter of a legitimate URL and executed them automatically when the page loaded, so a phishing link could start the attack. Copilot's data-leak safeguards applied only to the initial request, and follow-up instructions from an attacker's server kept the exchange going. The researchers disclosed the flaw to Microsoft on August 31, 2025, and Microsoft addressed it. Exploitation was not detected in the wild. Varonis clarified that Reprompt only impacted Copilot Personal, not Microsoft 365 Copilot, which is available to enterprise customers and is better protected by additional security controls, such as Purview auditing, tenant-level DLP, and admin-enforced restrictions.

What happened

1 · What it was doingCopilot runs prompts passed in a URL's q parameter as soon as the page loads.
2 · What it reached or didThe attack starts with a phishing email carrying a legitimate Copilot link.
3 · How it was caughtVaronis security researchers identified the method and reported it.

What was done

Microsoft addressed the issue after responsible disclosure.
Fix reported

“Microsoft fixed the issue after responsible disclosure”

No later incident for Microsoft under this risk on record.

Risks

Data leaked or sent out
Primary32 incidents
Credential and privilege abuse
Also37 incidents

Read from the sources; not yet reviewed by a person.

Controls

Not yet read for controls. Controls that mitigate the primary risk:

Harness

Network egress control

Application

Sensitive-data checks on outbound data · Output filtering and redaction · Human approval for high-impact actions · Data minimisation · Least-privilege access for the agent · Activity logs

Similar incidents

Reprompt: a single malicious Copilot link could expose user data2026-01-24
AutoJack flaw in Microsoft AutoGen Studio enabled code execution, fixed during development2026-06-22
SearchLeak flaw in Microsoft 365 Copilot exposed data2026-06-15
EchoLeak zero-click prompt injection exploit in Microsoft 365 Copilot2025-11-23

All cases of this kind ›

Evidence

No source states: what went wrong, when it happened, when it was found, how many records were exposed, the direct loss, a count of the other parties affected, any court case, the cause.

Show the full account: 1 items from the primary sources

What happened, in order

  1. 2025-08-31 Varonis responsibly disclosed the issue to Microsoft.
Show every field, with its source and grade

The AI system

Developer
Microsoft
C one secondary source states it
What it was allowed to do
access to user-provided prompts, conversation history and certain personal Microsoft data, depending on context and permissions
C one secondary source states it
What it was for
AI assistant for personal accounts, integrated into Windows, Edge and consumer applications
C one secondary source states it

What happened

Earliest source we hold
2026-01-14
D inferred by us from the described behaviour, reason shown
What set it off
hidden instructions in its input
C one secondary source states it
Who caught it
an independent researcher or journalist
C one secondary source states it
Who was responsible
the model provider
C one secondary source states it
Where its input came from
phishing email carrying a legitimate Copilot URL with a malicious q parameter
C one secondary source states it
What was done
Microsoft fixed the issue after responsible disclosure
C one secondary source states it
Earlier warning signs
Responsible disclosure of the flaw to Microsoft on 2025-08-31
C one secondary source states it
What went wrong
security breach
C one secondary source states it
AI agent
an AI agent acted
C one secondary source states it
primary risk
RK04
D inferred by us from the described behaviour, reason shown
secondary risks
RK03
D inferred by us from the described behaviour, reason shown

Impact

Severity
minor
D inferred by us from the described behaviour, reason shown

LR-2026-0386 · version 1 · published 2026-11-01 after automatic checks; not yet checked field by field by a person · JSON