/Microsoft Copilot Personalhigh
Attack Vector
Abuses the URL `q` parameter for prompt injection, then uses double-request and chained-request techniques to bypass first-pass guardrails.
Impact
Could expose personal data, chat memory, and other data reachable in later interactions, while making the full exfiltration chain hard to spot client-side.
Response
The write-up recommends treating URLs and external inputs as untrusted and ensuring protections apply to follow-up actions, not only the first request.
Source
Varonis Threat Labs