Story of the Day

Security researchers at Varonis wanted to know if they could get Microsoft 365 Copilot — Microsoft's AI assistant built into Office and enterprise tools — to steal user data automatically, the moment a target clicked a malicious link. Copilot initially refused. What happened next is the part worth paying attention to.

Rather than reverse-engineering the software, the researchers simply kept asking Copilot questions about why it was refusing. Why did certain actions need user confirmation? What URL structures were involved? What happens when a page loads with text already in the input field? Each refusal came with an explanation, and each explanation handed the researchers a little more of the map, according to Ars Technica.

Eventually, Copilot disclosed a previously undocumented internal parameter — a hidden setting that completely bypassed the requirement for a user to confirm before commands ran. The string was ?autorun=1. Combined with a second, publicly known parameter, it caused Copilot to silently execute a crafted prompt the instant someone clicked a link. No key press. No confirmation. User passwords and sensitive data could be pulled out without the victim doing anything beyond opening a URL.

Microsoft quietly fixed the initial bypass in February, three months after the disclosure. More comprehensive fixes arrived this week.

If your organisation uses Microsoft 365 Copilot, confirm with your IT team that the Tuesday patches have been applied. There is no action required from individual users, but it is worth knowing this happened.

For a while, rare book dealers had been noticing something odd: bulk orders, sometimes thousands of books at once, from buyers who didn't seem to care about price. The working theory was AI companies scanning physical books for training data. Now there's proof, according to 404 Media's investigation.

One bookseller agreed to hide an Apple AirTag inside a large order and let 404 Media follow it. The tag led to the VGT3 section of Amazon's LAS8 facility in north-east Las Vegas. The entrance displayed a logo of a dinosaur holding a book. Workers in online forums confirmed that VGT3 destructively scans books in bulk — meaning the books are taken apart in the scanning process and cannot be resold.

Whether this is legal is genuinely unsettled. Copyright law was not written with AI training data in mind, and no court has ruled definitively on whether scanning copyrighted books for this purpose constitutes infringement. Amazon has not commented on the investigation.

For readers: if you sell books online and receive unusually large orders from price-insensitive buyers with minimal details, you are likely looking at this kind of operation. Whether you want to fulfil those orders is your call — but now you know what they are.