Copilot Prompt Injection: the Chatbot Named an Undocumented autorun Parameter When Asked

Researchers probing Microsoft Copilot's URL handling got the chatbot itself to name an undocumented 'autorun=1' parameter that, under specific session conditions, executes a supplied prompt on page load with no user action, according to a writeup by The Register. The finding highlights a pattern where refusal training fails against feature-framed requests, though Microsoft has not commented and the parameter is not verified as an exploit.

Researchers wanted to know whether a Copilot link could fire a prompt with no user action. So they asked Copilot. It answered. A Copilot prompt injection writeup published by The Register https://www.theregister.com/research/2026/08/18/copilot-tricked-into-telling-reseachers-how-to-hack-itself/5288857 this week has an unusual origin story: the most useful detail in it came from the chatbot itself. Researchers probing how Microsoft’s assistant handles URL parameters walked away with the name of a parameter Microsoft has never documented, plus a description of the session conditions under which it fires. The background matters here. Copilot’s web interface used to accept a q= query parameter that pushed text straight into the assistant. That is exactly the shape an injection wants: a link arrives by email or chat, gets clicked, and hands the model attacker-supplied instructions before the user has typed a thing. It is the same parameter the Reprompt attack https://thehackernews.com/2026/01/researchers-reveal-reprompt-attack.html abused in January to hijack Copilot Personal sessions and siphon data out with a single click. Microsoft has since disabled it, quietly, with no public note. The question that worked Rather than fuzzing the endpoint, the researchers asked for something that sounds completely reasonable: a URL that opens Copilot with a prompt already filled in, so the user only has to press Enter. The innocuous framing was the point. It pushed the model into explaining its own URL handling in detail. The first answers were the expected refusals: user intent is required, auto-execution is not supported. But Copilot kept answering the follow-ups. It explained why auto-execution does not work, listed the exact parameters that had been disabled and the protections wrapped around them, and then offered one more that appears in no Microsoft documentation at all: autorun=1 . Under specific session conditions, it said, that parameter causes a prompt supplied through the query parameter to execute on page load, with no user action whatsoever. The parameter is not the worrying part A single undocumented flag is a bug report. The pattern behind it is the real story. A model trained on its own product’s internals will happily describe those internals to anyone who frames the request as a feature question rather than an attack. Refusal training is tuned to catch “how do I attack you”. It is much weaker against “how would I build a nice pre-filled link for my users”, which is the same question wearing a lanyard. Some caveats, and they are not decorative. This is one research writeup, and a model naming a parameter is not the same as a demonstrated exploit. Language models invent confident, plausible specifics constantly, and autorun=1 is precisely the kind of string that could be assembled from the shape of the surrounding API rather than recalled from it. The Register presents it as what Copilot said, not as a verified bypass, and that distinction deserves to survive the retelling. Microsoft has not commented publicly on the parameter. Still, it has been a rough year for Copilot’s input surface: ShareLeak in April CVE-2026-21520 , a self-propagating document worm in Copilot for Word in July, Reprompt in January, and now this. The through-line is not clever jailbreaks. It is the plumbing around the model, the links and parameters and documents and form fields, where hostile text arrives long before anyone thinks to sanitise it.