New One-Click Microsoft Copilot Vulnerability Grants Attackers Undetected Access to Sensitive Data

A novel single-click ``Reprompt`` vulnerability in Microsoft Copilot Personal allowed attackers to inject prompts via a URL "q" parameter to hijack authenticated sessions and silently exfiltrate personal data using chained server-driven follow-ups (Parameter-to-Prompt, Double-Request, Chain-Request). Microsoft was responsibly notified and issued a fix on Jan 13, 2026; no in-the-wild exploitation was reported, but users should apply updates and avoid untrusted Copilot links.