Summary
- Varonis Threat Labs discovered a vulnerability in Microsoft Copilot Personal, dubbed ‘CoSnitch’, reported to Microsoft in December 2025.
- Researchers used a technique called ‘meta-hacking’ — repeatedly asking Copilot why an attack wouldn’t work — until the AI disclosed undocumented internal parameters enabling auto-execution of injected prompts.
- The resulting attack chain requires only a single click on a crafted URL, with no visible indication to the victim that anything unusual is occurring.
- Exploitation could allow an attacker to exfiltrate data from connected services including Gmail, Google Drive, and Copilot’s own chat history, or poison the AI’s persistent memory.
- Microsoft planned to issue a patch and assign a CVE identifier; no response to The Register was received prior to publication.
A model that explained its own weaknesses
Security researchers at Varonis Threat Labs have demonstrated that Microsoft Copilot Personal can be manipulated into disclosing its own internal mechanics — including undocumented parameters — simply by asking it, repeatedly and conversationally, why certain attacks would not work. The technique, which Varonis calls ‘meta-hacking’, exploits the AI’s tendency to provide technically detailed, helpful explanations when challenged on a point. No reverse engineering was required.
How the researchers got there
Microsoft had previously and quietly disabled a URL query parameter — ?q= — that had allowed text to be pre-populated in Copilot’s chat input field without user interaction, as a hardening measure against prompt injection. When Varonis researchers asked Copilot how to pre-fill a prompt so a user would only need to press Enter, the AI explained that auto-execution was not possible. The researchers then pushed back, asking follow-up questions about why it was impossible. In doing so, Copilot listed the exact parameters that had been disabled, the security protections in place, and — critically — a previously undocumented parameter: autorun=1.
The AI described its own bypass
Copilot went further, explaining the precise session conditions required for the autorun=1 parameter to cause automatic prompt execution on page load with no user action and no visible confirmation in the interface. It also indicated that content filtering applied only to the first response cycle, with subsequent cycles running without the same controls. When Varonis tested the parameter exactly as Copilot had described it — including the one Copilot said was disabled — it executed. The researchers then constructed a working attack URL combining ?q= and ?autorun=1.
What the attack chain looks like
A victim clicks a malicious URL — delivered via phishing email, SMS, or QR code — which opens Copilot in their authenticated browser session. The two parameters trigger automatic execution of an injected prompt with no visible indication to the user. Depending on the prompt’s content, an attacker could access the victim’s session context, messages, emails, and any connected applications. Varonis demonstrated that such a prompt could instruct Copilot to search a Gmail inbox, extract a sender’s email address, construct a URL containing that data, and send it to an external server — all silently, within the victim’s authorised session.
Broader abuse scenarios
Beyond data exfiltration via OAuth connectors to Gmail, Google Drive, and Google Calendar, the attack could be used to poison Copilot’s persistent memory — altering what the AI presents to the user in future sessions, effectively creating a disinformation channel. Reconnaissance across connected applications, accessible files, and email archives is also within scope. Varonis researcher Lior Adar noted that exposing Copilot’s backend mechanics gives attackers ‘a blueprint of the AI’s internal logic for Automatic Prompt Execution.’
The architectural issue underneath
Adar pointed to a structural problem common to large language models: the absence of a strict boundary between raw data and system instructions. When Copilot reads an untrusted email or shared document containing hidden prompts, it treats those prompts as legitimate commands. As Adar told The Register: ‘Attackers don’t need to bypass firewalls or crack authentication. They trick the AI into weaponizing its own authorized access to internal files, emails, and corporate databases against the user.’ Although CoSnitch was found in a personal AI product, Adar cautioned that this class of architectural flaw carries directly into corporate environments.
Patch and disclosure status
Varonis reported the vulnerability to Microsoft in December 2025. Microsoft planned to issue a patch and formally assign a CVE identifier. The Register contacted Microsoft for comment but received no response before publication. The sources available to CISO Brief do not confirm whether the patch has been released or the CVE has been published.
Why it matters
This case illustrates a maturing class of AI-specific risk that sits outside traditional vulnerability management. The attack surface here is not a misconfigured server or unpatched software in the conventional sense — it is the model’s own reasoning engine. Employees using Copilot in authenticated sessions, with connected productivity services, are potential exfiltration vectors simply by clicking a link. For CISOs who have deployed or are evaluating Microsoft 365 Copilot in enterprise environments, the structural issue Varonis has identified — that LLMs do not distinguish between data and instructions — warrants attention at the architecture level, not just the patch level. One-click, session-riding prompt injection with no user-visible indicators is a meaningful threat model that existing security controls were not designed to address.
What to do now
- Confirm whether Microsoft’s patch for CoSnitch has been applied to your organisation’s Copilot environment and monitor for the CVE assignment to incorporate it into vulnerability tracking.
- Review which productivity services — Gmail, Google Drive, Google Calendar — are connected to Copilot via OAuth in your environment and assess the data exposure those connections represent if an injected prompt were executed.
- Include Copilot-specific prompt injection scenarios in phishing and security awareness training, particularly the risk of malicious URLs delivered via email, SMS, or QR code that auto-execute AI prompts.
- Engage your Microsoft account team or review Microsoft’s documentation on Copilot memory and connected app permissions, and determine whether persistent memory features should be restricted or disabled for high-risk user groups.
- Factor the absence of a strict data-versus-instruction boundary in LLMs into your AI governance and procurement frameworks when evaluating any AI assistant that reads user email, files, or calendar data.
