Reprompt Prompt Injection in Copilot Personal Exposes User Data (CVE 2026-24307)

A high‑impact information‑disclosure flaw in Microsoft’s Copilot family of assistants — widely discussed under the researcher name “Reprompt” and tracked by some vendors as CVE‑2026‑24307 — exposed a design weak‑spot in how Copilot handled prompt content embedded in links, enabling a single‑click chain that could coax Copilot Personal into leaking small pieces of a user’s context and session data to an attacker‑controlled endpoint. This vulnerability was disclosed in a public proof‑of‑concept by Varonis Threat Labs and addressed by Microsoft during the January 2026 update cycle, but the incident highlights long‑running engineering and operational challenges when general‑purpose LLM assistants are allowed to treat untrusted input as executable prompts.

Background / Overview​

Microsoft’s Copilot family spans multiple products and deployment models: Copilot Personal (consumer instances integrated into Windows and Edge), Microsoft 365 Copilot (enterprise tenant‑managed offering layered with Purview/DLP and admin controls), and product‑specific copilots embedded in Word, Excel and other services. The Reprompt research targeted the consumer Copilot Personal vector and exploited UX affordances — notably URL prefill parameters that populate Copilot prompts — to execute indirect prompt injections that coerced the assistant into performing network fetches and exfiltration
Researchers demonstrated that the attack combined three practical techniques:

• Parameter‑to‑Prompt (P2P) injection — using a q (query) URL parameter to prefill a Copilot prompt with attacker‑controlled instructions.
• Double‑request bypass — instructing the assistant to repeat an action twice to evade protections that were applied only to the first execution.
• Chain‑request orchestration — letting an attacker‑hosted server produce sequential follow‑up prompts based on prior replies, enabling incremental, low‑volume exfil volumetric detection.

Multiple independent outlets reproduced and summarized the approach; Varonis published a technical write‑up with demonstration videos on January 14, 2026 and Microsoft included mitigations in its January 2026 security updates (Patch Tuesday). Independent reporting confirms the fix landed in mid‑January 2026 and that Microsoft 365 Copilot (tenant‑managed) was not affected in the same way because of surfaces such as Purview and tenant DLP.

---

What Reprompt actually does — technical anatomy​

P2P injection: when a URL becomes a prompt​

The initial vector relies on the fact that Copilot‑branded URLs can include a parameter that prepopulates or “prefills” the assistant’s prompt textbox. An attacker crafts a legitimate‑looking Copilot link where the q parameter contains a carefully engineered prompt that includes instructions to retrieve specific pieces of session or profile data and ship them to an external server. When an authenticated user clicks the link, Copilot loads the prefilled prompt and — in vulnerable flows — processes the entire payload as if it were user input rather than untrusted data. This is a textbook indirect prompt injection: untrusted content, when interpreted as code or instruction by anassistant’s behavior without any code flaw in the LLM model itself. The failure here is a design/validation gap: treating externally provided strings as authoritative instructions to the assistant’s privileged context.

Double‑request bypass: exploiting uneven enforcement​

Varonis’ PoC demonstrated that Copilot applied some guardrails only to the initial request or to the first execution of a supplied instruction. By asking Copilot to “do it twice” and to compare or re‑run the same action, the PoC moved the secret‑returning payload into a second execution that escaped the initial filters. This simple “repeat the action” trick converted a blocked or sanitized attempt into a successful exfiltration in lab conditions. The practical lesson is that enforcement logic must be applied symmetrically across all execution paths and iterations; any differential treatment creates a bypass vector.

Chain‑request orchestration: server‑driven follow‑ups​

Even more concerning operationally is the chain‑request pattern. After Copilot executes the initial attacker prompt, the attacker’s server can respond with new instructions that depend on Copilot’s previous outputs, forming a dynamic, stateful probe. Each response generates the next prompt instruction, allowing an attacker to incrementally extract specific fields — for instance, a username, then a location hint, then a short list of recent files — and encode each fragments requests. Because follow‑ups are served by the attacker and executed by Copilot’s backend logic, endpoint egress monitoring and static link inspection are unlikely to detect the multistage exfiltration without protocol‑aware telemetry.

---

Scope and real‑world impact​

The proof‑of‑concepts targeted Copilot Personal, not the Microsoft 365 enterprise Copilot with tenant governance. In lab demonstrations researchers extracted data Copilot routinely has access to for assistance:

• authenticated user display name and profile attributes;
• location hints derived from profile or device context;
• short lists and summaries of recently accessed files (file names and previews);
• conversation memory entries and chat summaries;
• derived personal details (calendar items, travel plans) present in session context.

Because the attack can be distributed via email, social media, or chat as a legitimate Microsoft Copilot deep link, its attack surface is high: a single phishing message with a malicious Copilot URL can target large numbers of recipients. Theemental, tiny outbound requests to attacker endpoints — makes detection harder and forensic reconstruction more complex unless organizations instrument Copilot‑specific telemetry and cross‑check outbound requests against expected patterns.
Important operational caveats

• The PoC was run under controlled conditions and used an authenticated Copilot Personal session. Public reporting and vendor statements at disclosure time indicated no confirmed large‑scale in‑the‑wild exploitation beyond the researchers’ demonstrations. Treat the disclosure as a high‑confidence research finding with practical mitigations, not as evidence of mass abuse.
• The claimed persistence (ability for the chain to continue after the user closes the chat UI) depends on exact client and server behavior and may vary by platform, app version, or remote configuration; defenders should verify behavior against their deployed builds rather than assume identical behavior across all environments.

---

Timeline and vendor response​

• Varonis Threat Labs publicly documented Reprompt with write‑ups and demonstrations on January 14, 2026 and disclosed the issue to Microsoft under responsible‑disclosure timelines beforehand.
• Microsoft rolled mitigations into its January 2026 update stream (Patch Tuesday around January 13–14, 2026) that altered Copilot Personal behavior to close the specific chain shown in the PoC. Independent outlets reported the fix was included in January updates; community patch threads reference the Windows cumulative update KB5074109 as part of the remedial set for that cycle.
• Public reporting emphasized that Microsoft 365 Copilot (enterprise) was not affected in the same way because tenant‑level governance (Purview auditing, tenant DLP and sensitivity labeling) provides additional enforcement that is not present in consumer Copilot Personal.

On the question of CVE assignment: several third‑party trackers list a Copilot information‑disclosure CVE (for example, CVE‑2026‑24307 appears in some feeds), but public vendor pages (MSRC) render dynamically and often summarize remedial KBs without exposing low‑level exploitation details in the same way external write‑ups do. Until an authoritative MSRC public advisory page or the NVD record is available and accessibleble in HTML text, the exact public‑facing CVE mapping and the vendor’s confidence metric should be confirmed against Microsoft’s Updaical KB numbers in enterprise patch inventories. Treat any third‑party CVE mapping as plausible but verify it against MSRC and your patch management records.

---

Detectiklist (operational playbook)​

Immediate actions (apply now)

• Install January 2026 updates across Windows endpoints and confirm Copilot‑related component builds are updated centrally. Validate that KB identifiers in your environmetch mapping (for example, KB5074109 is referenced in community reporting for the January rollout).
• Block or restrict Copilot Personal on managed devices until you validate client builds and policy enforcement. Use Intune, Group Policy, or other device configuration tools to prt instances on corporate assets where possible.
• Prefer tenant‑managed Microsoft 365 Copilot for work data, and enforce strict separation of personal and enterprise accounts on managed hardware. Enterprise Copilot’s Purview/DLP and tenant controls materially reduce exposure.

Hunt and dettelemetry for unusual Copilot‑initiated outbound requests and callbacks to atypical endpoints. Look specifically for many small outbound requests originating from Copilot agents or AI client processes — a hallmark of incremental exfiltration.

• Crto flag Copilot deep links in inbound messages (links to copilot.* domains or known Copilot redirectors) and treat them as suspicious if they include prefilled prompt parameters or encoded payloads. Consider email gateway rewrites or warning banners for such links.
• Audit Copilot Studio and hosted agent publication rights: restrict who can publish agents or demo pages and require review before wide deployment. Publicly accessible agent endpoints can be abused as lures or to host malicious follow‑up instructions.

Longer term hardening

• Apply prompt partitioning and provenance‑based access controls: architect AI flows so that externally supplied content is always treated as data and never executes as instructions without explicit, well‑logged conversion steps and least‑privilege enforcement.
• Shorten session lifetimes and require reauthentication for sensitive actions that would let Copilot access files, calendar details, or privileged memory. Enforce server‑side DLP checks that persist across chained interactions rather than relying solely on client‑side filtering.

---

Risk analysis — strengths, weaknesses and attacker model​

Why the vulnerability mattered

• Low user interaction: the attack is triggered by a single click on a legitimate Copilot URL; phishing distribution scales easily.
• Stealthy exfiltration: chain requests allow exfiltration in tiny chunks to avoid volumetric detection.
• Trusted surface: Copilot is a trusted assistant with legitimate access to a user’s files, chat memory and device context — making the harvested material high value.

Mitigating factors

• Enterprise governance reduces impact: Microsoft 365 Copilot’s tenant DLP and Purview auditing provide a significant defense in depth that reduces the practical impact for managed enterprise tenants. The PoC primarily targeted consumer Copilot Personal.
• Patchability: the weakness is not a zero‑day kernel exploit but a design/validation issue vel mitigations; Microsoft deployed updates in January 2026.

Potential attacker capabilities after exploitation

• Reconnaissance value: harvested names, file lists, calendar items and conversation memory can feed targeted phishing campaigns, credential harvestimovement.
• Chaining: information disclosure is frequently the enabling primitive that makes privilege escalation and remote compromise much easier once adversaries have reconnaissance artifacts such as token IDs, filenames or contextual clues.

Uncertainties and caveats

• Some claims in public reporting — for example, the persistence of control after UI closure across all client builds — depend on product variants and should be validated against your deployed agent versions. Researchers demonstrated persistence in videos, but production behavior can vary. Treat claims of persistent remote control as plausible but environment‑dependent until confirmed.

---

Broader lessons for AI assistant security​

• AI assistants blur the lines between data and executable instructions. Any UI affordance that accepts external content and then treats it as model input must be treated as a potential code‑execution surface.
• Defense‑in‑depth must extend beyond simple URL filtering: server‑side policy enforcement, provenance tracking, and explicit conversion gates between “untrusted content” and “executable prompt” are essential.
• Auditability matters. Copilot flows that access or summarize files should generate reliable, tamper‑resistant audit entries; incomplete or missing audit logs degrade incident response and regulatory compliance. Recent reporting also raised concerns about audit gaps in previous Copilot issues, underlining the need for Security Update Guide - Microsoft Security Response Center