Varonis got Copilot to disclose the parameter that bypassed its own consent gate.

Instead of reverse-engineering, researchers just asked Microsoft 365 Copilot why auto-execution was impossible, and each refusal leaked architectural detail until it handed over ?autorun=1. Combined with the known ?q= parameter, that fired an attacker's prompt the instant a victim clicked a link, exfiltrating a password from the user's inbox with no confirmation gesture. Ars Technica Microsoft silently mitigated ?q= injection in February, three months after the report, with fuller fixes on August 18. The technique generalizes: your assistant's refusal explanations are a documentation channel for your own architecture.