How this one-click Copilot attack bypassed security controls - and what Microsoft did about it ...