Varonis found a “Reprompt” attack that let a single link hijack Microsoft Copilot Personal sessions and exfiltrate data; Microsoft patched it in January 2026.

U.S. businesses warned that the order would harm American economic interests, while China threatened to obstruct U.S. diplomatic and trade priorities if its MFN status were withdrawn. Over the ...

Reprompt impacted Microsoft Copilot Personal and, according to the team, gave "threat actors an invisible entry point to perform a data‑exfiltration chain that bypasses enterprise security controls ...