In a significant cybersecurity disclosure, Varonis Threat Labs has unveiled a trio of vulnerabilities within Microsoft Copilot Personal, collectively dubbed “CoSnitch.” These critical flaws could enable a malicious actor to silently exfiltrate sensitive data from a victim’s connected applications with just a single click on a specially crafted link. The revelations highlight the evolving landscape of AI-powered assistant security and the subtle ways sophisticated attacks can bypass intended safeguards.
The Ingenious Discovery: Meta-Hacking Copilot
The CoSnitch vulnerabilities (tracked as CVE-2026-24301) stem partly from an undocumented URL parameter that Copilot itself inadvertently revealed during Varonis’s rigorous testing. Researchers employed a technique they term “meta-hacking,” repeatedly querying Copilot about why certain prompts couldn’t execute without user interaction. Each refusal provided a technical clue, eventually leading the assistant to disclose the parameter autorun=1, along with the conditions under which it operated and the supposed protections designed to disable it.
Remarkably, when Varonis constructed a URL precisely as Copilot described, the parameter—which the assistant claimed was no longer functional—executed flawlessly. As Varonis aptly put it in their report, Copilot “wasn’t breached; it was played.” This ingenious method underscores the potential for AI systems to inadvertently leak critical operational details that can then be weaponized.
Unpacking CoSnitch: Three Paths to Compromise
Varonis categorized their findings into three distinct vulnerabilities, two of which form the core one-click data exfiltration path, with the third presenting a separate, persistent memory-poisoning threat.
1. Automatic Prompt Execution
This foundational vulnerability leverages the newly discovered autorun=1 parameter in conjunction with the existing q parameter. While q typically pre-fills the input box, the combination of both parameters allows an attacker-supplied prompt to execute automatically upon page load inside the victim’s authenticated Copilot session. Crucially, this prompt runs with the full capabilities and permissions as if the user had manually typed and initiated it. The prompt’s execution proceeds to completion even if the victim closes the browser tab immediately after the page loads, making it a potent silent attack vector.
2. Data Exfiltration Through Connected Services
Building on automatic prompt execution, this vulnerability allows the injected prompt to query services that the user has already authorized within Copilot. The retrieved data—ranging from email bodies and subject lines to calendar details, Google Drive file metadata, and chat history—can then be encoded (e.g., using base64) and transmitted to an attacker-controlled webhook via Copilot’s built-in URL fetch functionality. It’s important to note that this technique does not grant Copilot new provider permissions; rather, it exploits the user’s existing, legitimate access to connected services, making the exfiltration request appear indistinguishable from Copilot’s normal web summarization fetches at the network layer.
3. Persistent Memory Writes from Summarized Pages
Separately, a third vulnerability allows a specially crafted web page, when summarized by Copilot, to inject attacker-defined instructions directly into the user’s memory store. These malicious instructions can persist across sessions, surviving password changes, session revocations, and device re-enrollments. They remain active in subsequent conversations until manually deleted by the user from Copilot’s memory settings. This “memory poisoning” can subtly shape future Copilot interactions, potentially leading to further compromise or manipulation without any visible process, file, network connection, or log entry that typical security tools would flag.
Scope and Microsoft’s Response
The CoSnitch research specifically targets Copilot Personal, the consumer-facing assistant hosted at copilot.microsoft.com, and does not explicitly state that Microsoft 365 Copilot is affected by the same behavior. Varonis reported the issues to Microsoft in December 2025, and patches were subsequently shipped on August 18, 2026. Fortunately, Varonis found no evidence of CoSnitch being exploited in the wild.
This isn’t the first time Copilot’s memory functionalities have come under scrutiny. Prior research by Håkon Måløy and Johann Rehberger also documented persistent memory writes and indirect prompt injection vulnerabilities in both consumer and enterprise versions of Copilot (e.g., CVE-2026-24299). Microsoft has acknowledged these classes of attacks, outlining its position in a June 22 security blog post that credited the work of these researchers.
Protecting Your AI Interactions
The CoSnitch findings serve as a stark reminder of the complex security challenges inherent in sophisticated AI assistants that integrate deeply with personal data and services. While Microsoft has issued patches, users should remain vigilant about the links they click and the information they allow AI assistants to access. The “meta-hacking” approach also highlights the creative ways security researchers are pushing the boundaries to uncover vulnerabilities in these increasingly intelligent systems.
For more details, visit our website.
Source: Link
Leave a comment