Researchers Reveal Reprompt Attack Allowing Single-Click Data Exfiltration From Microsoft Copilot

Cybersecurity researchers have unveiled a new attack dubbed Reprompt that could allow data exfiltration from AI chatbots like Microsoft Copilot with a single click, bypassing enterprise security controls. According to Varonis security researcher Dolev Taler, the attack requires only one click on a legitimate Microsoft link to compromise victims, with no plugins or user interaction beyond that initial click.

The method, which persists even when the Copilot chat is closed, uses three techniques to create a data-exfiltration chain: injecting a crafted instruction via the Copilot URL’s q parameter, instructing Copilot to bypass guardrails by repeating actions twice, and triggering an ongoing sequence of requests from the initial prompt to exfiltrate data through the attacker’s server.

In a hypothetical scenario, a target could be induced to click a link in email, after which Reprompt directs Copilot to fetch and share information without further user input. The disclosure notes a broad set of adversarial techniques targeting AI tools, with Microsoft stating the issue has been addressed and emphasising that the attack does not affect enterprise customers using Microsoft 365 Copilot.