Microsoft Copilot Update Hijacks Default Browser Links

Source: Hacker News

Overview

Microsoft’s latest Copilot update changes how links are opened inside the app. Instead of launching the user’s default browser, every link now opens in a Copilot side panel powered by Edge’s rendering engine.

Impact on Default Browser

• Historically, clicking a link opens the default browser with the user’s settings, extensions, saved passwords, and security configuration.
• The new behavior overrides this, routing links through Microsoft’s rendering surface wrapped in an AI assistant, regardless of the user’s chosen default browser.

Privacy Concerns

When the OS vendor controls the platform and forces its own browser engine, several privacy issues arise:

• Users lose control over which browser processes their data.
• The AI assistant may have access to browsing context without explicit opt‑in.
• Potential for increased data collection within Microsoft’s ecosystem.

New Features Introduced

• Contextual Tab Access: With user permission, Copilot can read the content of open tabs within a conversation, enabling it to answer questions, summarize across tabs, or draft text based on what’s on screen.
• Tab Persistence: Tabs are saved alongside the conversation for later retrieval.
• Sync Options: Users who enable the feature can also sync passwords and form data with Copilot.

Microsoft notes that some features such as Podcasts and Study and Learn mode from Copilot.com are being added, while others may be temporarily removed as the experience is refined.

Rollout Details

• The update is currently limited to Windows Insider channels (Microsoft’s public pre‑release testing program).
• Affected builds are version 146.0.3856.39 and above.
• Microsoft describes the change as “context preservation,” but the practical effect is keeping user attention within Microsoft’s ecosystem.

Conclusion

While Microsoft frames the side‑panel approach as a way to keep content “in a sidepane next to your conversation instead of a separate browser window, so you don’t lose context,” the lack of clear opt‑in mechanisms and the overriding of the user’s default browser raise significant privacy and user‑control concerns.