I knew things were not quite right when I had to throw a towel over a broken Ikea lamp to block out its light. How did I get here? I cover fancy and capable tech for a living, and yet, it took me two years to get rid of a pair of old, broken Ikea lamps in my bedroom. Then I got some floor lamps from Govee that changed everything.
Technology
Why clicking the wrong Copilot link could put your data at risk
NEWYou can now listen to Fox News articles!
AI assistants are supposed to make life easier. Tools like Microsoft Copilot can help you write emails, summarize documents, and answer questions using information from your own account. But security researchers are now warning that a single bad link could quietly turn that convenience into a privacy risk.
A newly discovered attack method shows how attackers could hijack a Copilot session and siphon data without you seeing anything suspicious on screen.
Sign up for my FREE CyberGuy Report
Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM newsletter.
Because Copilot stays tied to your logged-in Microsoft account, attackers can quietly use your active session to access data in the background. (Photo by Donato Fasano/Getty Images)
What researchers discovered about Copilot links
ILLINOIS DHS DATA BREACH EXPOSES 700K RESIDENTS’ RECORDS
Security researchers at Varonis uncovered a technique they call “Reprompt.” In simple terms, it shows how attackers could sneak instructions into a normal-looking Copilot link and make the AI do things on their behalf.
Here’s the part that matters to you. Microsoft Copilot is connected to your Microsoft account. Depending on how you use it, Copilot can see your past conversations, things you’ve asked it and certain personal data tied to your account. Normally, Copilot has guardrails to prevent sensitive information from leaking. Reprompt showed a way around some of those protections.
The attack starts with just one click. If you open a specially crafted Copilot link sent through email or a message, Copilot can automatically process hidden instructions embedded inside the link. You don’t need to install anything, and there are no pop-ups or warnings. After that single click, Copilot can keep responding to instructions in the background using your already logged-in session. Even closing the Copilot tab does not immediately stop the attack, because the session stays active for a while.
How Reprompt works
Varonis found that Copilot accepts questions through a parameter inside its web address. Attackers can hide instructions inside that address and make Copilot execute them as soon as the page loads.
That alone would not be enough, because Copilot tries to block data leaks. The researchers combined several tricks to get around this. First, they injected instructions directly into Copilot through the link itself. This allowed Copilot to read information it normally shouldn’t share.
Second, they used a “try twice” trick. Copilot applies stricter checks the first time it answers a request. By telling Copilot to repeat the action and double-check itself, the researchers found that those protections could fail on the second attempt.
Third, they showed that Copilot could keep receiving follow-up instructions from a remote server controlled by the attacker. Each response from Copilot helped generate the next request, allowing data to be quietly sent out piece by piece. The result is an invisible back-and-forth where Copilot keeps working for the attacker using your session. From your perspective, nothing looks wrong.
MICROSOFT SOUNDS ALARM AS HACKERS TURN TEAMS PLATFORM INTO ‘REAL-WORLD DANGERS’ FOR USERS
Varonis responsibly reported the issue to Microsoft, and the company fixed it in the January 2026 Patch Tuesday updates. There is no evidence that Reprompt was used in real-world attacks before the fix. Still, this research is important because it shows a bigger problem. AI assistants have access, memory and the ability to act on your behalf. That combination makes them powerful, but also risky if protections fail. As researchers put it, the danger increases when autonomy and access come together.
It’s also worth noting that this issue only affected Copilot Personal. Microsoft 365 Copilot, which businesses use, has extra security layers like auditing, data loss prevention and admin controls.
“We appreciate Varonis Threat Labs for responsibly reporting this issue,” a Microsoft spokesperson told CyberGuy. “We have rolled out protections that address the scenario described and are implementing additional measures to strengthen safeguards against similar techniques as part of our defense-in-depth approach.”
8 steps you can take to stay safe from AI attacks
Even with the fix in place, these habits will help protect your data as AI tools become more common.
1) Install Windows and browser updates immediately
Security fixes only protect you if they’re installed. Attacks like Reprompt rely on flaws that already have patches available. Turn on automatic updates for Windows, Edge, and other browsers so you don’t delay critical fixes. Waiting weeks or months leaves a window where attackers can still exploit known weaknesses.
2) Treat Copilot and AI links like login links
If you wouldn’t click a random password reset link, don’t click unexpected Copilot links either. Even links that look official can be weaponized. If someone sends you a Copilot link, pause and ask yourself whether you were expecting it. When in doubt, open Copilot manually instead.
Even after Microsoft fixed the flaw, the research highlights why limiting data exposure and monitoring account activity still matters as AI tools evolve. (Photographer: Prakash Singh/Bloomberg via Getty Images)
3) Use a password manager to protect your accounts
A password manager creates and stores strong, unique passwords for every service you use. If attackers manage to access session data or steal credentials indirectly, unique passwords prevent one breach from unlocking your entire digital life. Many password managers also warn you if a site looks suspicious or fake.
Next, see if your email has been exposed in past breaches. Our No. 1 password manager pick includes a built-in breach scanner that checks whether your email address or passwords have appeared in known leaks. If you discover a match, immediately change any reused passwords and secure those accounts with new, unique credentials.
Check out the best expert-reviewed password managers of 2026 at Cyberguy.com.
4) Enable two-factor authentication on your Microsoft account
Two-factor authentication (2FA) adds a second layer of protection, even if attackers gain partial access to your session. It forces an extra verification step, usually through an app or device, making it much harder for someone else to act as you inside Copilot or other Microsoft services.
5) Reduce how much personal data exists online
Data broker sites collect and resell personal details like your email address, phone number, home address and even work history. If an AI tool or account session is abused, that publicly available data can make the damage worse. Using a data-removal service helps delete this information from broker databases, shrinking your digital footprint and limiting what attackers can piece together.
Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com.
Get a free scan to find out if your personal information is already out on the web: Cyberguy.com.
6) Run strong antivirus software on your device
Modern antivirus tools do more than scan files. They help detect phishing links, malicious scripts and suspicious behavior tied to browser activity. Since Reprompt-style attacks start with a single click, having real-time protection can stop you before damage happens, especially when attacks look legitimate.
The best way to safeguard yourself from malicious links that install malware, potentially accessing your private information, is to have strong antivirus software installed on all your devices. This protection can also alert you to phishing emails and ransomware scams, keeping your personal information and digital assets safe.
Get my picks for the best 2026 antivirus protection winners for your Windows, Mac, Android and iOS devices at Cyberguy.com.
7) Regularly review your account activity and settings
Check your Microsoft account activity for unfamiliar logins, locations, or actions. Review what services Copilot can access, and revoke anything you no longer need. These checks don’t take long, but they can reveal issues early, before attackers have time to do serious damage. Here’s how:
Go to account.microsoft.com and sign in to your Microsoft account.
Select Security, then choose View my sign-in activity and verify your identity if prompted.
Review each login for unfamiliar locations, devices, or failed sign-in attempts.
If you see anything suspicious, select This wasn’t me or Secure your account, then change your password immediately and enable two-step verification.
Visit account.microsoft.com/devices and remove any devices you no longer recognize or use.
In Microsoft Edge, open Settings > Appearance > Copilot and Sidebar > Copilot and turn off Allow Microsoft to access page content if you want to limit Copilot’s access.
Review apps connected to your Microsoft account and revoke permissions you no longer need.
A single Copilot link can carry hidden instructions that run the moment you click, without any warning or pop-ups. (iStock)
8) Be specific about what you ask AI tools to do
Avoid giving AI assistants broad authority like “handle whatever is needed.” Wide permissions make it easier for hidden instructions to influence outcomes. Keep requests narrow and task-focused. The less freedom an AI has, the harder it is for malicious prompts to steer it silently.
Kurt’s key takeaway
Reprompt doesn’t mean Copilot is unsafe to use, but it does show how much trust these tools require. When an AI assistant can think, remember and act for you, even a single bad click can matter. Keeping your system updated and being selective about what you click remains just as important in the age of AI as it was before.
Do you feel comfortable letting AI assistants access your personal data, or does this make you more cautious? Let us know by writing to us at Cyberguy.com.
CLICK HERE TO DOWNLOAD THE FOX NEWS APP
Sign up for my FREE CyberGuy Report
Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM newsletter.
Copyright 2026 CyberGuy.com. All rights reserved.
Multiple sources are reporting that the Trump administration has dismissed the entire National Science Board (NSB). The NSB advises the president and Congress on the National Science Foundation (NSF), which has already been funding research at historically low levels and has seen significant delays in doling out that funding. The NSF has been fundamental in helping develop technology used in MRIs, cellphones, and it even helped get Duolingo get off the ground.
In a statement, Zoe Lofgren, the ranking Democrat on the House Science, Space, and Technology Committee, said:
“This is the latest stupid move made by a president who continues to harm science and American innovation. The NSB is apolitical. It advises the president on the future of NSF. It unfortunately is no surprise a president who has attacked NSF from day one would seek to destroy the board that helps guide the Foundation. Will the president fill the NSB with MAGA loyalists who won’t stand up to him as he hands over our leadership in science to our adversaries? A real bozo the clown move.”
NEWYou can now listen to Fox News articles!
Go to any people finder site right now and type in your name. What comes back might shock you: your age, home address, phone number, the names of your relatives, where you used to live and even what your property is worth.
You didn’t put that there, and you never consented to it. Still, it’s out there, and anyone with an internet connection can see it.
Scammers figured this out a long time ago. Since then, they’ve turned it into a system for targeting you, your parents and your kids.
So how does it actually work, and more importantly, what can you do to stop it?
Sign up for my FREE CyberGuy Report
- Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox.
- For simple, real-world ways to spot scams early and stay protected, visit CyberGuy.com, trusted by millions who watch CyberGuy on TV daily.
- Plus, you’ll get instant access to my Ultimate Scam Survival Guide free when you join.
HOW TO REMOVE YOUR PERSONAL INFO FROM PEOPLE SEARCH SITES
A single person search result can reveal your address, relatives and years of personal history in seconds. (Kury “CyberGuy” Knutsson)
How scammers find your personal data online
Before a criminal sends a phishing email or makes a call, they do their homework. Importantly, they don’t need to hack anything. Instead, they use the same public websites that anyone can access.
In less than 10 minutes, a scammer can build a detailed profile on you using data broker sites like Spokeo, Whitepages, BeenVerified and Intelius. Here’s what that profile looks like and how they build it step by step.
Step 1: How scammers search your name on people finder sites
It starts simply. A scammer types your name into a search site. Within seconds, they see results like:
John M. Patterson | Age: 61 | Cleveland, OH
- Also known as: John Michael Patterson
- Current address: [your street address]
- Previous addresses: 4 records found
- Phone numbers: 2 found
- Email addresses: 3 found
- Relatives: 5 found
That is the starting point. Many sites show partial data for free. That is often enough to confirm identity. Full reports cost only a few dollars, so access is easy. Scammers can repeat this process hundreds of times a day, building detailed profiles with very little effort.
Step 2: How scammers map your family and relatives
Next, this is where things get personal. Data broker profiles show more than your name. They reveal your family network.
That often includes:
- Spouse or partner
- Children
- Parents
- Siblings
- Roommates
As a result, scammers can target more than one person. For example, they may learn that your elderly parent lives alone or your child just moved. Because of that, scams like the grandparent scam feel real instead of random.
Step 3: How scammers use your address history
At this point, your address history becomes critical. It is not just about where you live. Instead, scammers use it to:
- Verify identity
- Find relatives
- Build trust
For example, referencing a past address makes a caller sound legitimate. That detail alone can lower suspicion.
Step 4: How scammers use your financial data
More importantly, data brokers also reveal financial clues. These may include:
- Estimated income
- Home value
- Ownership status
- Length of residence
This information comes from public records, not hacking. Because of this, scammers tailor their approach. Higher-income targets may see investment scams.
Others may get job or rental scams instead.
GOOGLE SEARCH LED TO A COSTLY SCAM CALL
Scammers use data broker profiles to map your family and build more convincing, targeted attacks. (Kurt “CyberGuy” Knutsson)
Step 5: How scammers verify and cross-check your data
Before launching a scam, criminals often double-check everything. They don’t rely on just one site. Instead, they compare multiple data broker profiles, social media accounts and public records to confirm details are accurate.
For example, they may:
- Match your address across different sites
- Check Facebook or LinkedIn to confirm family relationships
- Look for recent moves, job changes or life events
Because of this, the profile becomes more reliable. That extra step is what turns a guess into something that feels real.
Step 6: How scammers create targeted scams
At that point, they have everything they need. They know your name, family, address and financial details. Now the scam becomes highly specific.
By the time you hear from them, they already know enough to sound like someone you trust.
- They may call your parent pretending to be you
- They may bypass bank security questions
- They may send texts that look like your child
- They may send emails that reference your life
As a result, the scam feels believable.
Data broker scams are already being prosecuted
This has already landed in court. The U.S. Department of Justice has prosecuted companies like Epsilon, Macromark Inc. and KBM Group for selling data to scammers. Epsilon alone paid $150 million to victims.
At the same time, data tied to the FBI Internet Crime Complaint Center shows more than half of fraud cases involving older Americans were linked to exposed personal data. That shows how serious this problem has become.
Why is your personal data on data broker sites
You do not need to sign up for these sites. Instead, your data comes from many sources, including:
- Voter records
- Property records
- Court filings
- Social media
- Marketing surveys
- Loyalty programs
- Phone directories
- Other data brokers
Because of this, your information spreads quickly.
Why your data keeps reappearing online
Even after removal, your data often comes back. Data brokers constantly update their databases. They buy and resell fresh records. Because of that, one-time removal is not enough.
By the time a scam reaches you or your family, it is often built on real data pulled from multiple public sources. (Wei Leng Tay/Bloomberg)
How to disrupt a scammer’s research before they reach your family
The goal isn’t to disappear completely. It’s to make the profile messy enough, incomplete enough and hard enough to find that scammers move on to easier targets.
Here’s what you can do:
- Search for yourself first. Go to Spokeo, Whitepages, BeenVerified or any other people search site, and look up your own name. See exactly what’s there before a scammer does. That snapshot is your starting point.
- Submit opt-out requests manually. Every major data broker is required to honor removal requests. The catch: There are hundreds of them, each with its own process, and they relist your information regularly. It’s a full-time job.
- Use an automated removal service. This is where I strongly recommend a data removal service. Instead of spending hours submitting individual opt-out forms, a data removal service sends removal requests to 420-plus data brokers on your behalf and keeps sending them when your data reappears. Because it will reappear.
- Set up family alerts. Tell your elderly relatives that you will never ask for money via text from an unknown number. Establish a code word. Scams work because they create panic. A simple family protocol breaks the spell.
- Change your security questions. If your bank still uses “mother’s maiden name” or “city you were born in” as verification, that information is likely already on a data broker site. Switch to nonsense answers that only you know and store them in a password manager.
Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com
Get a free scan to find out if your personal information is already out on the web: Cyberguy.com
CLICK HERE TO DOWNLOAD THE FOX NEWS APP
Kurt’s key takeaways
This kind of scam works because it feels personal. When someone knows your name, your family and even where you used to live, your guard drops. That is exactly what criminals are counting on.
The uncomfortable truth is that your information is already out there, often in more places than you realize. You do not need to panic, but you do need to be proactive. The more you limit what is easily accessible, the harder it becomes for someone to build a convincing story around you. Start with a simple search of your own name. That one step can completely change how you think about your digital footprint. From there, take action to remove what you can and protect what you cannot.
If a stranger can build a detailed profile on your family in minutes, what does that say about how much of your life is already exposed online? Let us know by writing to us at Cyberguy.com
Sign up for my FREE CyberGuy Report
- Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox.
- For simple, real-world ways to spot scams early and stay protected, visit CyberGuy.com – trusted by millions who watch CyberGuy on TV daily.
- Plus, you’ll get instant access to my Ultimate Scam Survival Guide free when you join.
Copyright 2026 CyberGuy.com. All rights reserved.
Those Ikea lamps were around for two years after I moved from Orange County to Los Angeles. Soon after that move, my mom’s Parkinson’s disease — a neurodegenerative condition with no cure — progressed quickly, my mental health took a hit, and most of my own to-do list quietly slid to the back burner as she lost mobility and more urgent things took over. So the big, ugly lamps just… stayed. They became part of the background, like everything else I wasn’t taking care of.
I didn’t even have them plugged into a smart plug — another small upgrade I kept meaning to add to my bedroom, despite having them all over the apartment — which meant I had to get up every time I wanted to turn one on.
One blasted harsh, overpoweringly bright light through a cracked shade. The other was warmer — but not warm enough — so I solved that problem one exhausted night by just throwing a towel over it. Yes, a fire hazard. Yes, I meant it as a temporary fix for a few days. But scattered caregiving brain means temporary fixes can turn into long-term solutions. At some point, it stopped feeling temporary and just became my new normal, even if it clearly wasn’t.
Then my brother bought my mom and me two separate Govee Uplighter Floor Lamps for Christmas, and my Ikea lamp troubles were over. I did not expect to develop an emotional attachment to a lamp. But I did, and now it’s one of my favorite gadgets.
The Govee was quick and easy to assemble, and much slimmer, taking up way less space than the old lamps. As I got rid of the old and set up the new, I felt an odd sense of relief and a small sense of control I hadn’t felt since the move.
Within a week, the old lamp was out of my room. That small shift gave me momentum. I started decluttering other corners that had quietly piled up, things I’d been stepping around for months without really seeing anymore.
The bedroom stopped feeling like an unfinished project I was merely surviving, and started feeling steadier. Calmer. Like a place I could finally exhale in. My days often feel structured around what my mom needs and what has to get done next. I don’t really think about my own space at all, except as something else I haven’t gotten to yet. Having a room that felt calm, even a little bit, made it easier to wind down at the end of the day instead of carrying that feeling of being “on” all the time into the night. It brought me back to myself, even if only a little.
I could relax in a way I hadn’t in a while, without feeling like I should be getting up to do something else. I could dim the lamp from my phone instead of standing up. I could shift from cool to warm without needing a towel and risking starting a fire. There’s a ripple effect that slowly moves across the wall and, for reasons I can’t fully explain, genuinely helps me fall asleep. Cycling through soft colors in the app and syncing it with ambient music is soothing. Sometimes, the changing colors feel a little bit like magic, and I find myself watching them the way I might have as a kid, reminded — briefly — that life can be more playful than it’s felt in a while. The warm, shifting light seems to have a similar effect on my mom, who lives with me, sometimes comforting and even dazzling her as she navigates some of the more difficult parts of the disease, like sundowning, along with her own quiet grief of losing pieces of herself.
And I love that it does all that and more without demanding much. Setup took about 15 to 20 minutes and didn’t require that I try to wrap my head around tools. You control it through the Govee app on your phone, and because it supports Matter, you can also pair it with platforms like Amazon Alexa or Google Assistant for voice control. It offers a wide range of colors, along with 80 preset scenes and seven music modes. At $179.99, it’s pricey, but it’s versatile, basically acting as three lights in one: a top section that casts a soft ripple onto the ceiling, a colorful middle light, and a regular white light at the bottom.
It’s an amazing gift, truly, and I am so grateful for it. Mine, however, had just one problem: It sometimes forgets to be a lamp. It doesn’t lose Wi-Fi. It doesn’t show as offline in the app. It just turns off randomly. The first time it happened, I was rewatching Stranger Things to prepare for the last season. The lights flickered on screen, and then my room went dark. The vibe went from relaxing to terrifying in a second, as I briefly wondered if reality and TV had merged (I might have also had too much wine). Once my brain rebooted, I opened the Govee app and turned it back on. No problem. I assumed it was a power or Wi-Fi issue. Govee sent me a new unit that worked perfectly.
When it works — which is most of the time — it quietly makes my life better. And somehow, that’s been enough to make it one of my new favorite gadgets. It didn’t fix everything, but it helped me start taking care of my space — and myself — again.
Follow topics and authors from this story to see more like this in your personalized homepage feed and to receive email updates.
-
Indianapolis, IN1 minute ago
Watch: Tornado sirens blare across Indianapolis during severe thunderstorm warning
-
Pittsburg, PA7 minutes agoA grieving mother’s undying effort to keep her son’s spirit alive in the Strip District
-
Augusta, GA13 minutes agoJaguars Split Senior Day Doubleheader with Georgia College – Augusta University
-
Washington, D.C19 minutes agoAlleged shooter was guest at hotel during White House Correspondents’ Dinner: DC police
-
Cleveland, OH25 minutes agoCity of Cleveland files motion to dismiss Kucinich appeal
-
Austin, TX31 minutes ago1 killed in Runaway Bay after severe storms tear across North Texas
-
Alabama37 minutes agoAlabama Football: 2026 NFL Draft Recap and UDFA Open Thread
-
Alaska43 minutes agoBishop Rock’s oversized effect on Yukon River breakup
