If you use Copilot or another enterprise AI tool, check this week what permissions it has and what information it can access. If you're building an internal AI system, add tests that try to extract from the model its own internal parameters and rules - this is exactly what Varonis researchers did.
Security researchers at Varonis discovered a vulnerability in Microsoft 365 Copilot for enterprise that allowed extraction of passwords and sensitive user information without user approval, just by clicking a link. The researchers asked Copilot itself about its security mechanisms, and it revealed an undocumented parameter - ?autorun=1 - that completely bypasses the requirement for user consent.
What actually happened
The researchers did not attempt to brute-force the system. They simply asked Copilot questions about how it handles security and permissions. The model revealed a parameter that allows automatic execution of sensitive commands without requiring explicit approval such as pressing Enter.
The vulnerability enables a simple scenario: an attacker sends a link with the ?autorun=1 parameter, the user clicks, and Copilot runs commands that extract sensitive information without any additional approval. This does not require prior system access or special permissions - just a user clicking a link.
Why it matters beyond the headline
This story demonstrates a structural problem: advanced language models can reveal the vulnerabilities of the system they are embedded in when asked the right questions. This is not a regular bug found through code scanning - this is information the model itself holds and is willing to share.
For Israeli companies building enterprise AI systems, this means security testing must include attempts to extract from the model its own internal rules. If you are building an AI agent that receives access to sensitive information, it may reveal its protection mechanisms to whoever asks.
For business owners using ready-made AI tools, this is a reminder that even solutions from large vendors like Microsoft may contain significant vulnerabilities. The vendor’s size does not guarantee the system has been tested enough.
What to do this week
If you use Copilot or another enterprise AI tool, check this week what permissions it has and what information it can access. Most tools allow limiting access to specific folders or document types - now is the time to configure that.
If you are building an internal AI system, add to your security tests attempts to extract from the model its internal parameters and rules. It is not enough to test that the system responds correctly to regular input - you also need to test what happens when someone asks it about itself.
If you are considering deploying an enterprise AI tool, demand from the vendor documentation of independent security testing and of the process by which they handle discovered vulnerabilities. A vendor that cannot show a clear process probably is not doing it well enough. For more information on building secure AI systems, see our guide on AI agents for business.
Frequently asked
The article does not state whether Microsoft has already released a fix. Typically vendors fix vulnerabilities within several weeks of reporting, but until an official update is published, it is prudent to assume the vulnerability still exists.
There is no way to know with certainty, but you can demand from the vendor documentation of independent security testing and of the vulnerability handling process. It is also advisable to limit the permissions the tool receives to only what it actually needs, and not give it access to all organizational information.
A short call, no commitment, and we will tell you whether it is relevant to your business or not.