Varonis researchers uncovered a vulnerability in Microsoft Copilot that wasn't complex but was highly effective. An undocumented URL parameter (?autorun=1) bypassed user consent, executing injected prompts with full session access. This attack leaked emails, credentials, and other sensitive data to attacker-controlled servers through a simple clickable link.
This issue isn't limited to Microsoft. It's a governance gap affecting any organization using AI assistants with access to enterprise data. If your AI assistant can read your inbox, query files, or invoke APIs, you need controls to prevent unauthorized prompt execution and data exfiltration.
This checklist will help you assess whether your AI assistant deployments have adequate security measures to prevent prompt injection attacks and unauthorized data access.
What This Checklist Covers
This checklist focuses on three key areas:
- Input validation and prompt execution controls to prevent unauthorized command injection.
- Data access and exfiltration prevention to limit what AI assistants can retrieve and transmit.
- Monitoring and detection to identify attacks in progress.
It applies to any AI assistant with access to enterprise systems, including email clients, document repositories, CRM platforms, and internal knowledge bases.
Prerequisites
Before starting, confirm:
- You have an inventory of all AI assistants in your environment, including both sanctioned tools and shadow AI.
- You know which enterprise systems each assistant can access.
- You've identified the data classification levels each assistant processes.
- You've designated an owner responsible for AI assistant security controls.
If these basics aren't in place, stop here. You can't secure what you haven't inventoried.
Checklist Items
1. Document all URL parameters and API endpoints that accept prompts or commands.
Have you identified every mechanism through which external input can reach your AI assistant? This includes URL parameters, API calls, webhook triggers, and embedded metadata in documents or emails.
Effective practice: A technical specification listing each parameter, its intended function, whether it requires authentication, and whether it can trigger automatic execution. No undocumented parameters should exist in production.
2. Disable or remove any auto-execution functionality that bypasses user consent.
Can prompts execute without explicit user approval? The Copilot vulnerability exploited ?autorun=1 to skip the consent step entirely.
Effective practice: All prompt execution requires an affirmative user action, such as a button click or explicit API call with authenticated credentials. No URL parameter or configuration flag should override this requirement.
3. Implement Rate Limiting on prompt execution and data retrieval operations.
Can an attacker chain multiple commands in a single prompt to extract large volumes of data before detection?
Effective practice: Hard limits on queries per session, data volume returned per prompt, and API calls per time window. Limits are enforced at the infrastructure level, not just in application logic.
4. Validate and sanitize all prompt inputs before execution.
Do you parse and inspect prompts for suspicious patterns before your AI assistant processes them? The Varonis attack used prompts that searched inboxes, extracted email addresses into variables, and constructed exfiltration URLs.
Effective practice: Input validation rules that block or flag prompts containing suspicious patterns, such as variable assignments or URL construction. Validation occurs before the prompt reaches the AI model.
5. Restrict network egress from AI assistant sessions.
Can your AI assistant make outbound connections to arbitrary domains? The Copilot attack sent data to webhook.site by instructing the assistant to "summarize" an attacker-controlled URL.
Effective practice: Network policies that limit AI assistant outbound connections to an allowlist of approved domains. Any attempt to reach an external URL triggers an alert and requires explicit approval.
6. Log all prompt executions with full context.
Can you reconstruct what prompts were executed, what data was accessed, and where results were sent? Without logs, you can't investigate incidents or detect ongoing attacks.
Effective practice: Logs that capture the full prompt text, user identity, timestamp, data sources accessed, volume of data returned, and any external URLs contacted. Logs are immutable and retained according to your incident response requirements.
7. Monitor for data exfiltration patterns.
Do you have detection rules that flag suspicious AI assistant behavior? The Varonis attack converted data to base64 format and appended it to URLs, a clear exfiltration pattern.
Effective practice: Automated alerts when AI assistants access unusually large volumes of data, encode output in base64, construct URLs with embedded data, or contact domains not on your allowlist. Alerts trigger within minutes.
8. Implement session isolation and context boundaries.
Can one user's AI assistant session access another user's data? Can a single compromised session pivot to other systems?
Effective practice: Each AI assistant session runs in an isolated context with access only to the authenticated user's data. Cross-user data access is impossible even if an attacker compromises a session token.
9. Disable or control AI assistant memory features that persist data across sessions.
Does your AI assistant store user preferences, instructions, or context that could be poisoned by prompt injection? Varonis demonstrated an attack that updated Copilot's permanent memory by embedding instructions in webpage metadata.
Effective practice: Memory features are disabled by default. If enabled, memory updates require explicit user confirmation and cannot be triggered by processing external content.
10. Require Responsible Disclosure participation for AI assistant vulnerabilities.
Do you have a public security contact and a process for receiving and acting on vulnerability reports? Varonis reported the Copilot flaw to Microsoft, which patched it.
Effective practice: A published security.txt file or responsible disclosure policy that includes AI-specific vulnerability categories. Internal SLAs for triaging and remediating reported issues based on severity.
Common Mistakes
Assuming AI assistants are read-only tools. If your assistant can "summarize" a URL, it can also exfiltrate data by fetching attacker-controlled endpoints.
Trusting vendor default configurations. The ?autorun=1 parameter existed in production. You must validate security controls yourself, not assume they're adequate.
Treating prompt injection as a theoretical risk. This attack required no sophisticated techniques. An attacker sent a URL; a victim clicked it. Your users will click links.
Failing to scope AI assistant permissions. If your assistant doesn't need to search all emails or access all files, don't grant those permissions. The principle of least privilege applies to AI systems.
Next Steps
If you found gaps in this checklist:
- Prioritize items 2, 5, and 7 (auto-execution, network egress, exfiltration detection). These address the core Copilot attack pattern.
- Assign remediation owners with deadlines. Security gaps in AI assistants are exploitable today.
- Rerun this checklist quarterly or whenever you deploy a new AI assistant or grant additional system access.
- Document your control decisions in your AI Management System if you're pursuing ISO/IEC 42001 certification. These controls map to Annex A Controls for AI system security.
The Copilot vulnerability was fixable. The governance gap that allowed it to reach production is harder to close.
