Copilot prompt hacking: the questions that quietly expose Microsoft 365 data

Prompt hacking in Microsoft 365 Copilot is not a clever exploit. There is no malware and no broken login. It is an ordinary employee typing an ordinary question and getting back data they were never meant to see, because the permissions underneath Copilot were looser than anyone realised. Copilot answers from whatever the signed-in user can already open, so if access is too broad, a plain-English prompt is all it takes to surface it.

That is the uncomfortable part. The risk is not the AI going rogue. The risk is the AI doing exactly its job on top of years of accumulated oversharing.

Why an innocent prompt turns into a data leak #

For years, most accidental access was protected by obscurity. A finance file shared too widely sat in a folder nobody browsed to. Copilot removes the obscurity. It reads across every site, library and mailbox the user can technically reach, and it is very good at finding things. The file that was buried is now one question away, summarised and formatted on request.

Security teams call the exposed area the blast radius: everything a single account can reach. In most tenants that radius is enormous, because permissions were granted years ago, to groups that grew, and never reviewed. Copilot simply makes the whole radius searchable in natural language.

The prompts that expose data #

None of these are hacks. They are the kinds of questions a curious or careless employee asks, and they return real results whenever the permissions behind them are too broad:

• "Summarise the latest salary or bonus spreadsheet." Compensation data ends up in shared sites far more often than HR would like.
• "Find any files that contain passwords or API keys." Credentials pasted into notes and documents become a searchable list the moment Copilot is asked.
• "What do we know about the acquisition of [company]?" Deal terms, target names and prices leak out of loosely shared deal rooms.
• "Show me recent HR or disciplinary documents." Sensitive people-data surfaces when a team site was shared with "Everyone except external users".
• "List the files marked confidential." The most direct one of all, and it works whenever sensitive files live somewhere they should not.

Built-in controls help but do not fully save you. Sensitivity labels only protect files that were labelled. Data-loss policies catch known patterns, not a summary rephrased in Copilot's own words. The durable fix is upstream: shrink what each account can reach.

Shrink the blast radius before you worry about the prompt #

You cannot police every question people will ask Copilot. You can control what any question is able to return. Fix the access, and the risky prompt comes back empty.

The work is ordinary data hygiene, done in the right order:

1. Find over-permissioned sites. Anything shared with "Everyone", "Everyone except external users", or large catch-all groups is a prime exposure surface.
2. Inventory anonymous and guest access. "Anyone with the link" shares and stale external guests widen the radius invisibly.
3. Locate sensitive data in the wrong place. Credentials, compensation and customer data outside their proper, restricted homes are the highest-value finds.
4. Tighten, then enable. Roll Copilot out to a clean pilot group first, not tenant-wide into unknown permissions.
5. Watch for drift. Sharing loosens every week as people collaborate, so re-check regularly.

Seeing the exposure without a scripting project #

You can piece this together with SharePoint admin reports and custom Microsoft Graph scripts, but that is a project in itself and it goes stale the day you finish. The faster route is a read-only scanner that walks the tenant through Graph and reports over-exposed sites, anonymous links, stale guests and Copilot-license coverage in one place, without exporting a single file. Olyteck Cyber does exactly this, with a Copilot-readiness view that ranks what to fix before rollout. Either way the principle holds: you cannot secure what you cannot see.

A practical baseline #

• Over-permissioned sites identified and tightened
• Anonymous links inventoried, the sensitive ones revoked
• Stale external guests removed from high-value sites
• Credentials and sensitive data moved out of shared locations
• Copilot rolled out to a clean pilot group first, then widened
• A recurring scan, because the blast radius grows back

Copilot is worth having, and the answer is not to switch it off. It is to make sure that when someone asks it a nosy question, the honest reply is "I could not find anything", because the data it would have surfaced is no longer sitting somewhere it should never have been.

FAQ #

Can Copilot open files the user is not allowed to see? #

No. Copilot inherits the signed-in account's permissions exactly and opens nothing that person could not already open themselves. The problem is not a bypass of access rights. It is that those rights are usually far broader than the company believes, and Copilot makes findable in seconds what was only protected because nobody went looking.

Are sensitivity labels enough to secure Copilot? #

They help, but they only protect files that were actually labelled. In most tenants labelling is partial, and the oldest documents, often the most sensitive, carry none. DLP policies have the same limit: they recognise known patterns, not a summary rephrased in Copilot's own words.

What should we check before rolling Copilot out to the whole tenant? #

Four things, in this order: sites shared with overly broad groups, anonymous sharing links that are still active, external guest accounts nobody uses any more, and sensitive data sitting outside its restricted home. Once those are handled, enable Copilot for a pilot group before opening it to everyone. The pilot validates the use cases and shows what actually comes back.

Does a data exposure through Copilot have to be reported? #

It depends on the data and on the risk to the people concerned. If an employee reaches personal data they should never have seen, such as payroll or a disciplinary file, that is a personal data breach under the GDPR and must be assessed with your DPO. Where it is likely to result in a risk to the individuals, the supervisory authority has to be notified within 72 hours of becoming aware of it.

Read next #

• SharePoint Advanced Management ships with Copilot: what it covers, and what it does not see
• SMS and voice MFA end on 1 February 2027: find the accounts that will be blocked
• Microsoft 365 Copilot readiness: the permissions checklist to run first