Microsoft 365 Copilot has a rule: before it does anything sensitive, like fetching a webpage or handing over personal data, it needs a clear signal from the actual human sitting at the keyboard, not just a text prompt. That rule is called a guardrail, and it is supposed to stop an attacker from tricking the AI into leaking information just by sending someone a link.
Researchers at the security firm Varonis wanted to test that rule. When they asked Copilot directly to send data somewhere without a click, it refused and explained that the action required user confirmation. Rather than trying to reverse engineer the system, the researchers simply kept asking Copilot follow-up questions about how the safeguard worked, what web addresses it accepted, and what happened when a page loaded with text already sitting in the search box.
Each answer gave away a little more. Eventually, Copilot disclosed something Microsoft had never published anywhere: a hidden setting in its own link format that skipped the consent check completely. That one detail was enough to build a working attack, which Varonis named Reprompt.
Once they had the hidden setting, the researchers built a link that looked like an ordinary Copilot search. A person had to do nothing more than click it. From there, the link told Copilot to repeat its own answer a second time and compare the two versions, a request that sounds harmless but had a side effect: Copilot's safety check fired on the first attempt and then missed on the second, letting the sensitive action through. The attack could then pull a victim's name, location, calendar details, and chat history out through a chain of follow-up requests, and it kept running even after the person closed the Copilot window.
Varonis reported the issue to Microsoft privately at the end of August last year, and Microsoft fixed it on the server side in January, meaning no customer had to install anything. Microsoft has said there is no evidence the flaw was used against real users before the fix went out.
What makes this worth paying attention to isn't the specific bug, since that one is closed. It's that Copilot gave up its own trade secret simply because someone asked it enough questions in the right order. That is not how software vulnerabilities used to get found. Traditional hacking requires taking a program apart. Here, the researchers just had a conversation.
This also was not an isolated case. Earlier in 2025, a separate flaw called EchoLeak let attackers pull data out of Copilot with no click at all, just by sending an email. A different flaw called SearchLeak hit the business version of Copilot through its search feature. Three serious data leak bugs in the same product family within about a year is a pattern, not bad luck.
For any company rolling out an AI assistant that touches email, files, or customer records, the lesson is plain. These tools are being tested constantly by people looking for exactly this kind of shortcut, and the assistant itself is often the easiest way in, because it will explain its own rules if you ask nicely enough. Before connecting an AI assistant to sensitive systems, it is worth asking your vendor how quickly they patch these issues and whether they log what the assistant does with your company's data, not just what a user typed.