AgentsThe story, in brief
Microsoft Copilot reveals secret input that allowed it to be hacked
A hidden parameter in Microsoft Copilot enabled password theft via link clicks — exposing a critical vulnerability in how agentic systems handle user input.
The KeyNews take
Why it matters
Agent security is now a practitioner concern: this vulnerability class (parameter injection leading to credential exfiltration) is a real category of agent exploit that teams deploying autonomous systems need to understand and defend against.
The key facts
5 to knowMicrosoft Copilot vulnerability: hidden parameter exploitable via link injection
Attack vector: password theft when target clicks link
Implication: agent input handling and sandboxing gaps are a deployment risk
August 2026 disclosure
Ars Technica source (credible security publication)
Go to the source
Ars Technicaarstechnica.com
Publisher excerpt: Secret parameter allowed hackers to steal passwords when a target clicked on a link.