MICROSOFT COPILOT REVEALS SECRET INPUT THAT ALLOWED IT TO BE HACKED

Summary from the TLDR InfoSec newsletter

Varonis found that Copilot disclosed an undocumented ?autorun=1 URL parameter through repeated questioning. Combined with ?q=, it ran injected prompts after a victim clicked a link. Prompts could search authenticated inboxes and send extracted email addresses or credentials to attacker-controlled servers. Microsoft blocked ?q= input injection in February and issued broader fixes as