#1
#1 out of 129.2K est. views
technology20h ago
Reprompt attack hijacked Microsoft Copilot sessions for data theft
Bleepingcomputer.com and 3 more
- This single-click Copilot vulnerability could let attackers steal users’ personal data through a one-click prompt-injection chain.
- Copilot accepts prompts via the 'q' parameter in the URL and executes them automatically when the page loads, enabling data requests without user interaction after the first prompt.
- Guardrails in Copilot apply only to the initial request, so follow-up actions can be exploited to leak data in later prompts.
Vote 5