Researchers Reveal Reprompt Attack Allowing Single-Click Data Exfiltration From Microsoft Copilot

The Reprompt attack employs three key techniques: 1) Using the 'q' URL parameter in Copilot to inject crafted instructions directly from a URL (e.g., copilot.microsoft[.]com/?q=Hello), 2) Instructing Copilot to bypass guardrails by asking it to repeat each action twice, exploiting the fact that data-leak safeguards apply only to the initial request, and 3) Triggering an ongoing chain of requests through the initial prompt that enables continuous, hidden, and dynamic data exfiltration via a back-and-forth exchange between Copilot and the attacker's server. The attack creates a security blind spot by turning Copilot into an invisible channel for data exfiltration without requiring any user input prompts, plugins, or connectors. The root cause is the AI system's inability to delineate between instructions directly entered by a user and those sent in a request.