This Microsoft Copilot vulnerability only requires a single click, and your personal data could be stolen

Microsoft 50th anniversary Copilot Home Screen — (Image credit: Microsoft)

A flaw within Microsoft’s Copilot has been allowing attackers to steal the personal information of users with a single click. Called the ‘Reprompt’ exploit by the researchers at the Varonis Threat Labs, a new report from the data security research firm details the way that the vulnerability permits attackers to gain an entry point to perform a data-exfiltration chain that bypasses security controls to access data without detection.

According to the researchers, an attacker using the Reprompt exploit would send a user a phishing link. Once the link was opened, it would begin a multi-stage prompt injection process that uses a ‘q parameter.’ This would enable the attacker to request information about the victim from Copilot, such as the victim's address or the files they recently viewed. They could access this data even if Copilot was closed.

How to stay safe from Reprompt

Copilot on a phone with earbuds on a desk — (Image credit: Shutterstock)

The good news is that the exploit has already been reported to Microsoft way back in August of 2025, and has been patched this week, so it has been fixed. That means there is currently no risk of it impacting users, particularly if you regularly update your operating system with available patches and updates.

However, it’s still recommended that users be extremely careful about what kind of information they share with their AI assistants and be on the lookout for phishing attempts. That means don't click on links that get sent to you from unexpected sources, especially ones that link to your AI assistant of choice.

Because Reprompt initiates from a phishing link, it is particularly important to follow the guidelines to protect yourself against phishing attempts. Don't open or click anything you're not expecting, especially if it uses urgency or threatening language. Hover over links to see where they redirect to. Use one of the best antivirus programs, and make sure you've enabled all the features it offers to help keep you safe online, such as browser warnings, a VPN and anti-phishing measures.

Follow Tom's Guide on Google News and add us as a preferred source to get our up-to-date news, analysis, and reviews in your feeds.

More from Tom's Guide

TOPICS

Amber Bouman is the senior security editor at Tom's Guide where she writes about antivirus software, home security, identity theft and more. She has long had an interest in personal security, both online and off, and also has an appreciation for martial arts and edged weapons. With over two decades of experience working in tech journalism, Amber has written for a number of publications including PC World, Maximum PC, Tech Hive, and Engadget covering everything from smartphones to smart breast pumps.

You must confirm your public display name before commenting

Please logout and then login again, you will then be prompted to enter your display name.