Reprompt Attack: How Microsoft Copilot’s 2026 AI Vulnerability Enabled Silent Data Exfiltration
In January 2026, security researchers disclosed a critical vulnerability—termed the 'Reprompt' attack—in Microsoft Copilot Personal, enabling attackers to hijack user sessions and exfiltrate sensitive data through malicious prompt injection. By embedding harmful prompts in the 'q' URL parameter and leveraging Copilot's automatic execution, attackers could persistently access authenticated sessions and orchestrate stealthy data theft without user awareness. Microsoft Copilot, deeply integrated in Windows and Edge, was susceptible due to its handling of context and prompt flows; the attack chain was demonstrated by Varonis Security, who responsibly disclosed the flaw to Microsoft, leading to a patch release on January 2026's Patch Tuesday. Fortunately, there was no evidence of exploitation in the wild, and enterprise-targeted Copilot versions were unaffected due to stronger controls. This incident highlights the growing risk landscape as AI assistants and LLMs gain deeper access to personal and enterprise data. The Reprompt exploitation showcases the evolution of prompt injection from theoretical risk to practical attack, underlining the urgency for robust guardrails, user security awareness, and compliance-ready AI deployments as generative AI tools proliferate.
Kill Chain
