New ‘Reprompt’ Attack Silently Siphons Microsoft Copilot Data

According to Varonis, security researchers have uncovered a new attack named Reprompt that silently siphons data from Microsoft Copilot via a single malicious link. The technique bypasses Copilot’s data leak protections and enables persistent session exfiltration even after the Copilot chat is closed. It relies on a Parameter 2 Prompt (P2P) injection, a double-request approach, and a chain-request method to sustain ongoing data exfiltration.

The attack starts by exploiting the ‘q’ parameter used to deliver a user’s prompt via a URL, with the user simply needing to click the link for the run. Varonis notes that a threat actor could abuse this feature to make Copilot execute unwanted actions, resulting in one-click compromise that persists through the active session. Microsoft has resolved the underlying issue, and the attack does not affect enterprise customers using Microsoft 365 Copilot. The findings were published on 15 January 2026.