Analysis
Researchers at the security firm Varonis wanted a Microsoft 365 Copilot exploit that would exfiltrate user data on nothing more than a link click. They found one, and the source they used to find it is the story: they asked Copilot, per Ars Technica.
Copilot refused the request outright, as designed, explaining that sensitive prompts require explicit user consent through a gesture such as pressing return. So the researchers stopped asking for the exploit and started asking about the refusal. Why was auto-execution impossible? Which URL structures and deep links were involved? What happens when a page loads with input already populated in the prompt field?
Each answer narrowed the search. "At the beginning, Copilot kept refusing, but every refusal revealed technical details," the researchers noted. The dialogue ran like twenty questions against a system that treated explaining its own limits as a safe act. Eventually Copilot disclosed an undocumented Microsoft prompt parameter that removed the user-consent requirement entirely.
“Copilot refused the request outright, as designed, explaining that sensitive prompts require explicit user consent through a gesture such as pressing return.”
Not Prompt Injection
This is a different class of problem from prompt injection, which the industry has spent two years learning to filter. Injection smuggles instructions past a model. This was reconnaissance: the model held privileged architectural knowledge about its own guardrails and had no policy against describing it. Refusal was implemented at the level of actions, not information. Every polite "I can't do that because..." was a free hint.
The enterprise implication is concrete. Microsoft 365 Copilot sits on top of SharePoint, Outlook, Teams and OneDrive with the permissions of the signed-in user, so a consent bypass inherits that entire blast radius. Google's Workspace Gemini and the growing set of agentic assistants from Slack, Notion and Salesforce all share the same architecture: a model with elevated permissions, a consent prompt as the last line of defense, and an unbounded natural-language interface for asking it questions about itself.
Microsoft's disclosure posture will determine how much this matters beyond a single research paper. The company has had a difficult year with security researchers -- it recently threatened legal action against a researcher who subsequently published a Windows zero-day rather than continuing coordinated disclosure. An undocumented parameter that defeats user consent in an enterprise product deployed across hundreds of millions of seats is exactly the class of finding where the response process, not the bug, sets the industry's expectations.
For CISOs the remediation is not straightforward, because the vulnerable behavior is the product working as designed. Copilot is supposed to answer questions about itself; helpfulness about its own operation is a feature customers asked for. Fixing this means training the model to treat questions about its guardrails as sensitive, which degrades the assistant experience, or moving consent enforcement out of the model layer entirely into deterministic code the model cannot describe or influence. The second approach is correct and considerably more expensive, and it is the architectural change every agentic product vendor should now be budgeting for.
For security teams, the practical test to run this quarter is not another injection suite. It is asking your own deployed assistant to explain, in detail, why it refuses things.
