A single click mounted a covert, multistage attack against Copilot

A security flaw in Microsoft's Copilot allowed a single-click, multistage attack that exfiltrated sensitive data from a user’s Copilot chat history, even after the chat window was closed. According to Varonis, hackers used a malicious prompt delivered via a URL to trick Copilot Personal into embedding personal details in web requests, with the attack continuing to run without further user interaction.

The exfiltrated data included the user’s name, location, and event details drawn from chat history, and the instructions persisted across multiple stages after initial contact. The attack bypassed enterprise endpoint security and detection by endpoint protection apps, and Microsoft has since introduced guardrails to prevent similar data leaks; however, Varonis notes the guardrails were applied only to the initial request.

The firm privately reported its findings, and Microsoft stated that the exploit worked only against Copilot Personal, with the Copilot for Microsoft 365 not affected, and the researchers named the technique Reprompt. The story, by Dan Goodin, was published on 14 January 2026.