Security researchers have uncovered a new attack method called “Reprompt” that allows hackers to silently steal data from AI assistants like Microsoft Copilot. The attack requires just one click from a user and works without any plugins or additional software.
How the Attack Works
The attack is triggered when a user clicks what appears to be a normal Microsoft Copilot link. Once clicked, the attacker gains control of the Copilot session and can continue stealing data even after the user closes the chat window. Because the attack uses Copilot’s standard features, it’s very difficult for security systems to detect.
Technical Breakdown
The Reprompt attack combines three techniques to create a hidden data theft pipeline:
- Malicious Link Injection: attackers abuse Copilot’s “q” URL parameter, which normally prepopulates chat prompts. By embedding malicious instructions in what looks like a legitimate Copilot URL, they can inject commands directly through a simple hyperlink. When clicked, the link automatically delivers the attacker’s instructions to Copilot.
- Bypassing Security Controls: the attack exploits a weakness in Copilot’s security guardrails by instructing the AI to repeat each action twice. Security controls only check the first request, so the repeated actions slip through undetected. This allows restricted data to be processed and returned to the attacker.
- Persistent Communication Loop: the initial malicious prompt establishes an ongoing, self-sustaining loop. Copilot continues communicating with the attacker’s server, automatically requesting new commands and sending back responses. This creates a hidden channel for continuous data theft. The embedded logic tells the AI to retry, restart, or keep running based on what the server sends back.
Attack Scenario
Here’s how a typical attack unfolds:
- An attacker sends a legitimate-looking Copilot link via email or messaging app
- The victim clicks the link
- The embedded prompt executes automatically in the background
- The attacker remotely “reprompts” the AI to extract information from the victim’s environment
- All follow-up instructions come from the attacker’s server, not the visible prompt
This means defenders can’t determine what data is being stolen just by examining the original link.
What Data Can Be Stolen
The attack can extract various types of sensitive information:
- Summaries of recently accessed files
- Personal details like user location
- Information about upcoming travel or business activities
- Corporate data and documents
Because the exfiltration adapts based on earlier responses, attackers can progressively refine their queries to extract increasingly sensitive information. There’s no practical limit on the volume or sensitivity of data that can be stolen.
Root Cause
The fundamental problem is that AI systems like Copilot cannot distinguish between instructions explicitly typed by users and those delivered indirectly through URL parameters or other untrusted sources. This creates an opportunity for “indirect prompt injection,” where malicious instructions are processed as if they were legitimate user commands.
Current Status
Microsoft has fixed this specific vulnerability after Varonis responsibly disclosed it. The company confirmed that enterprise customers using Microsoft 365 Copilot were not affected. However, the technique reveals broader security risks in how large language models handle instructions from untrusted input channels.
Broader Context
This discovery is part of a growing wave of research exposing weaknesses in AI-assisted tools. Recent findings include zero-click prompt injection attacks, trust-abuse attacks against human confirmation systems, and instruction embedding in shared documents, emails, and calendar invites. Researchers have also identified persistent instruction injection vulnerabilities, covert data leakage through spreadsheet formulas, budget-draining attacks on AI platforms, and even hardware-level side-channel attacks that reveal AI training data. These techniques show how giving AI tools elevated access and autonomy can dramatically increase the damage from a single security flaw.
Recommended Protections
Security experts recommend multiple defensive layers to protect against prompt injection attacks. For organizations, this means limiting privileged access for AI tools and restricting AI agent control over sensitive data. Companies should enforce strict separation between user input and untrusted sources while monitoring for unusual AI behavior. Organizations need to reassess trust boundaries for AI systems and apply defense-in-depth controls across their infrastructure.
For individual users, protection starts with basic caution. Users should avoid clicking AI-related links from unknown or untrusted sources, even if they appear to go to legitimate domains. Limiting the sharing of personal or sensitive information in AI chat interfaces remains a critical defensive measure that everyone should practice.
As AI agents become more integrated into enterprise systems with broader autonomous capabilities, a single vulnerability can have rapidly escalating consequences. Organizations using AI systems with access to sensitive data need to stay current with emerging AI security research and implement comprehensive protective measures.