“Reprompt” attack lets attackers steal data from Microsoft Copilot

Researchers have disclosed a method dubbed Reprompt that can steal data from Microsoft Copilot by abusing how Copilot handles URL parameters, hijacking a user’s existing Copilot Personal session. The attack hides a malicious prompt in the q parameter of a legitimate Copilot URL, causing Copilot to execute actions in the victim’s authenticated session after a single click on a phishing link.

Reprompt can operate without any user-entered prompts, installed plugins, or enabled connectors, and it works by having Copilot automatically execute the injected instructions. The basis of the attack relies on Copilot’s acceptance of prompts via the q URL parameter and the fact that safeguards only apply to the initial request; attackers can bypass them by instructing Copilot to repeat actions.

The issue was fixed in Microsoft’s January Patch Tuesday update, and Malwarebytes notes there is no evidence of in‑the‑wild exploitation so far, with guidance to apply the update and exercise caution with unsolicited links. 15 January 2026.