Reprompt: (Patched) One Click Copilot Exploit Enabled Stealth AI Driven Data Theft

Du'aine Davis

For awareness

• Varonis Threat Labs discovered Reprompt, a one‑click attack affecting Microsoft Copilot Personal, where users are compromised simply by clicking a legitimate‑looking Microsoft link (patched as of 14 January 2026). Threat actors could silently access sensitive personal data long after the Copilot tab was closed. Microsoft 365 Copilot enterprise customers were not affected.
• The attack abuses the q URL parameter to auto‑inject prompts (P2P injection), combined with double‑request and chain‑request techniques to bypass Copilot guardrails. These allow persistent, hidden, server‑driven data exfiltration without further user interaction and without client‑side tools detecting malicious behaviour.
• Users are advised to avoid unexpected AI‑related links, review pre‑filled prompts, and report unusual Copilot behaviour. Vendors should treat all external inputs as untrusted, enforce least privilege, maintain safeguards across chained actions, and implement anomaly detection. Microsoft Defender telemetry should monitor suspicious outbound URL fetch patterns and repeated AI‑initiated network calls.

Reprompt: The Single-Click Microsoft Copilot Attack that Silently Steals Your Personal Data