# Copilot prompt hacking: the questions that quietly expose Microsoft 365 data > Microsoft 365 Copilot answers from whatever a user can already open. These are the everyday prompts that surface data you thought was hidden, and how to shut them down. Source: https://olyteck.com/blog/copilot-prompt-hacking-microsoft-365-data-exposure Published: 2026-07-24 Author: Oleg Garasym, Olyteck (France, EU-hosted) Product: Olyteck Cyber Topics: copilot, prompt hacking, data exposure, microsoft 365, dspm License: free to quote with attribution to Olyteck and a link to the source URL. --- Prompt hacking in Microsoft 365 Copilot is not a clever exploit. There is no malware and no broken login. It is an ordinary employee typing an ordinary question and getting back data they were never meant to see, because the permissions underneath Copilot were looser than anyone realised. Copilot answers from whatever the signed-in user can already open, so if access is too broad, a plain-English prompt is all it takes to surface it. That is the uncomfortable part. The risk is not the AI going rogue. The risk is the AI doing exactly its job on top of years of accumulated oversharing. ## Why an innocent prompt turns into a data leak For years, most accidental access was protected by obscurity. A finance file shared too widely sat in a folder nobody browsed to. Copilot removes the obscurity. It reads across every site, library and mailbox the user can technically reach, and it is very good at finding things. The file that was buried is now one question away, summarised and formatted on request. Security teams call the exposed area the **blast radius**: everything a single account can reach. In most tenants that radius is enormous, because permissions were granted years ago, to groups that grew, and never reviewed. Copilot simply makes the whole radius searchable in natural language. ## The prompts that expose data None of these are hacks. They are the kinds of questions a curious or careless employee asks, and they return real results whenever the permissions behind them are too broad: - **"Summarise the latest salary or bonus spreadsheet."** Compensation data ends up in shared sites far more often than HR would like. - **"Find any files that contain passwords or API keys."** Credentials pasted into notes and documents become a searchable list the moment Copilot is asked. - **"What do we know about the acquisition of [company]?"** Deal terms, target names and prices leak out of loosely shared deal rooms. - **"Show me recent HR or disciplinary documents."** Sensitive people-data surfaces when a team site was shared with "Everyone except external users". - **"List the files marked confidential."** The most direct one of all, and it works whenever sensitive files live somewhere they should not. Built-in controls help but do not fully save you. Sensitivity labels only protect files that were labelled. Data-loss policies catch known patterns, not a summary rephrased in Copilot's own words. The durable fix is upstream: shrink what each account can reach. ## Shrink the blast radius before you worry about the prompt > You cannot police every question people will ask Copilot. You can control what any question is able > to return. Fix the access, and the risky prompt comes back empty. The work is ordinary data hygiene, done in the right order: 1. **Find over-permissioned sites.** Anything shared with "Everyone", "Everyone except external users", or large catch-all groups is a prime exposure surface. 2. **Inventory anonymous and guest access.** "Anyone with the link" shares and stale external guests widen the radius invisibly. 3. **Locate sensitive data in the wrong place.** Credentials, compensation and customer data outside their proper, restricted homes are the highest-value finds. 4. **Tighten, then enable.** Roll Copilot out to a clean pilot group first, not tenant-wide into unknown permissions. 5. **Watch for drift.** Sharing loosens every week as people collaborate, so re-check regularly. ## Seeing the exposure without a scripting project You can piece this together with SharePoint admin reports and custom Microsoft Graph scripts, but that is a project in itself and it goes stale the day you finish. The faster route is a read-only scanner that walks the tenant through Graph and reports over-exposed sites, anonymous links, stale guests and Copilot-license coverage in one place, without exporting a single file. Olyteck Cyber does exactly this, with a Copilot-readiness view that ranks what to fix before rollout. Either way the principle holds: you cannot secure what you cannot see. ## A practical baseline - Over-permissioned sites identified and tightened - Anonymous links inventoried, the sensitive ones revoked - Stale external guests removed from high-value sites - Credentials and sensitive data moved out of shared locations - Copilot rolled out to a clean pilot group first, then widened - A recurring scan, because the blast radius grows back Copilot is worth having, and the answer is not to switch it off. It is to make sure that when someone asks it a nosy question, the honest reply is "I could not find anything", because the data it would have surfaced is no longer sitting somewhere it should never have been.