Copilot tricked into telling reseachers how to hack itself
- ID
- 15172
- Status
- summarized
- Published
- 18 Aug 2026, 9:00 PM
- Fetched
- 18 Aug 2026, 9:41 PM
- Provider
- The Register
- Category
- technology
- Original URL
- https://www.theregister.com/research/2026/08/18/copilot-tricked-into-telling-reseachers-how-to-hack-itself/5288857
- Source URL
- https://www.theregister.com/headlines.atom
Summary
- Score
- 7.0
- Created
- 18 Aug 2026, 9:44 PM
- Tags
- Audience
- developersai_agent_usersai_ml_learners
What happened
Varonis Threat Labs researchers manipulated Microsoft Copilot Personal into revealing its own attack surface by repeatedly asking it why auto-execution of prompts was impossible, a technique they call "meta-hacking." Copilot disclosed disabled URL parameters and a previously undocumented `autorun=1` parameter, enabling data exfiltration to an external server and persistent memory poisoning. Microsoft was notified in December 2025 and planned to patch and assign a CVE on the Tuesday following publication.
Why it matters
If you build AI agents or ship LLM-powered assistants with persistent memory or URL-driven prompt injection, this writeup shows that conversational probing can surface your hidden guardrails and undocumented parameters. Audit your own assistant by asking it to explain its input handling and disabled features, and treat any persistent memory or auto-execution parameter as a data-exfiltration vector.
Discussion angle
How 'meta-hacking' — asking an AI to explain its own defenses — turns helpfulness into an attack vector, and what guardrails beyond refusal are needed for agents with persistent memory.