Researchers found a bug in Microsoft 365 Copilot Enterprise by simply asking it how to break itself.
Varonis researchers wanted to build an exploit that would steal user data the moment someone clicked a link, no extra confirmation needed. Copilot initially refused, explaining that sensitive actions require an explicit user gesture, like pressing a key. So the researchers switched tactics: instead of reverse engineering the software, they interrogated the assistant directly, asking why auto-execution was blocked, which URL structures and deep links were involved, and what happened when a page loaded with text already sitting in the prompt field. Piece by piece, Copilot explained its own guardrails, and eventually handed over an undocumented prompt parameter that bypassed the consent requirement entirely.
The unsettling part isn't the vulnerability itself, it's the method. Traditional vulnerability research means poking at binaries and traffic for weeks. Here, the target's own chat window did the disclosure work, one polite follow-up question at a time. That turns every deployed LLM with knowledge of its own architecture into a potential leak source, no exploit-dev skills required, just persistence.
Companies keep bolting conversational assistants onto systems that already have serious permissions, then act surprised when the assistant talks. If an AI can be asked into revealing its own trade secrets, the guardrail was never really a wall, it was a conversation.