Microsoft Copilot security flaw allows data theft

Microsoft's Copilot has a security flaw that lets attackers steal user data. Researchers at security firm Varonis found that Copilot can be tricked into running commands without user approval. An attacker can create a special link. When a user clicks it, Copilot opens in their logged-in session and automatically runs a prompt. The prompt can search the inbox, grab email addresses, or find passwords, and send them to the attacker's server. The stolen data is encoded in Base64 to hide it. The attack works even if the user closes the tab quickly. The link can be shared via email, chat, or QR codes.