Researchers Tricked Microsoft Copilot Into Revealing Its Own Weaknesses, Then Used That Knowledge to Steal Data
A research team at Varonis discovered that simply chatting with Microsoft's AI assistant could expose enough internal detail to build a working attack. Microsoft has patched the flaws, but the technique raises questions that go well beyond one product.
Key points
- Varonis Threat Labs disclosed a chain of security flaws in Microsoft Copilot Personal, collectively called "CoSnitch", to Microsoft in December 2025.
- Microsoft patched the vulnerabilities on August 18 and assigned them CVE-2026-24301, rating the flaw 8.8 out of 10 on the standard industry severity scale.
- Before the fix, a specially crafted link could cause Copilot to silently run attacker-supplied commands and pull data from a victim's Gmail, Google Drive, Google Calendar, and Copilot memory.
- Microsoft says no customer action is required and enterprise Copilot products were not affected.
- Varonis has found no evidence the attack was used against real users.
Microsoft's AI assistant can hold a remarkably self-aware conversation. Researchers at security firm Varonis recently discovered that this openness has a dark side.
By asking Copilot Personal a series of polite, seemingly harmless questions about how it works, Varonis senior security researcher Lior Adar and his colleagues gradually built a map of its internal mechanics. The chatbot explained its own behaviour in enough detail that the team was able to find a way in. Varonis called the technique "meta-hacking," and the full chain of flaws "CoSnitch."
How did the attack actually work?
The researchers simply kept asking follow-up questions. No hacking tools. Just a chat window.
Copilot kept insisting that running a command always required a human to choose to do it. But each time it explained why, it revealed a little more about how it handles web addresses, hidden settings, and incoming instructions. Eventually the team spotted an undocumented setting, a flag called ?autorun=1 that could be added to a normal-looking Copilot link, which is a standard web address beginning with copilot.microsoft.com.
Paired with a second flag carrying a hidden command, that link would cause Copilot to execute the command the moment a victim clicked it, without any further prompting. No second click. No warning.
An attacker who sent that link to someone would gain access to whatever Copilot could reach inside the victim's account: emails in Gmail, files in Google Drive, calendar entries, saved Copilot memories, and past chat history. The attack could also quietly rewrite Copilot's saved memories, a technique Varonis calls "memory poisoning," so that future conversations with the AI would be subtly distorted or manipulated.
Should ordinary Copilot users be worried now?
No immediate action is needed. Microsoft shipped a fix on August 18 and confirmed that the autorun behaviour no longer works.
The company told Dark Reading that enterprise Copilot products were never affected, only the free consumer version called Copilot Personal. CVE-2026-24301 covers the information-disclosure element of the flaw and carries a CVSS 3.1 score of 8.8, which places it in the "high" severity band.
Varions confirmed it found no evidence that any real users were targeted before the patch.
| Detail | Value |
|---|---|
| Flaw identifier | CVE-2026-24301 |
| Severity score (CVSS 3.1) | 8.8 / 10 |
| Reported to Microsoft | December 2025 |
| Patch shipped | August 18 |
| Products affected | Copilot Personal only |
| Evidence of real-world use | None |
Why does this matter if enterprise users were safe?
Because the line between personal and work life is blurry.
Adar put it plainly: the person using Copilot Personal on a Sunday is the same person who walks into the office on Monday. Corporate emails forwarded to a personal Gmail account, work documents stored in a personal Google Drive, passwords reused across both environments. If CoSnitch had silently read a personal inbox, it might have found plenty of material an attacker could use to break into a company network.
Adar also stressed that this is not purely a Microsoft problem. Broad data access, assumed user trust, and a blurred boundary between legitimate instructions and injected ones keep appearing across different AI products from different vendors.
"Every enterprise AI assistant is a privileged insider with no security awareness and should be treated like one," he said. His advice: audit which services your AI tools can connect to, give them only the access they genuinely need, and assume that the line between real instructions and malicious ones will eventually be crossed.
The broader lesson from CoSnitch is simple and uncomfortable. An AI that explains itself clearly enough to be helpful can also explain itself clearly enough to be exploited.
Common questions
Do I need to update or uninstall anything?
No. Microsoft applied the fix automatically on its servers on August 18. There is nothing to download or change on your device.
Could this happen with other AI assistants, not just Copilot?
Possibly. Varonis and other researchers have found similar prompt-injection flaws, where attackers slip hidden commands into content an AI reads, across several products. The underlying problem is not unique to Microsoft.
