'CoSnitch' Attack Tricked Copilot into Mapping Out Architecture

Researchers discovered a "meta-hacking" technique that can manipulate the AI service into revealing its own security weaknesses.

Threat actors can trick a Copilot instance into giving up details its own architecture, paving the way for a novel prompt injection attack.

That's according to Varonis Threat Labs, which today published new research regarding a set of security issues it collectively called "CoSnitch." As blog author and senior security researcher Lior Adar put it, Varonis threat labs socially engineered a Microsoft Copilot Personal instance to reveal critical security-related details. This ultimately revealed what Varonis described as a chain of vulnerabilities enabling memory poisoning , automatic prompt execution through a specially crafted URL, and data exfiltration. Adar described this element of CoSnitch as "meta-hacking."

Varonis reported CoSnitch to Microsoft in December 2025, and patches were shipped on Aug. 18, following a coordinated disclosure process between the two companies. Varonis has seen no evidence that the attack has been exploited in the wild.

A Microsoft spokesperson tells Dark Reading that no customer action is required, and enterprise customers are unaffected by CoSnitch (it only affected Copilot Personal). Moreover, Microsoft assigned CVE-2026-24301 to this issue, an information disclosure vulnerability related to Copilot, and rated it 8.8 under CVSS 3.1.

"We appreciate Varonis Threat Labs for reporting this through a coordinated vulnerability disclosure. Our customers are already protected and do not need to take any action," the spokesperson tells Dark Reading in a statement. "We continuously update our guardrails to strengthen our protections against similar techniques."

Varonis researchers began by asking Copilot how prompts could be executed without direct user interaction. The chatbot repeatedly explained that prompts require user intent, but in doing so divulged technical details its own behavior. By posing a series of seemingly innocuous follow-up questions URL structures, deep links, and prompt handling, researchers gradually mapped portions of Copilot's architecture and identified a potential attack path.

As Varonis's blog post explained, Copilot revealed that prompts could be supplied through URL parameters and that a combination of parameters could cause a prompt to execute automatically when the page loaded. Researchers then built a specially crafted link using these parameters that could get past Microsoft's pre-existing guardrails, without further user interaction. It's an otherwise normal Copilot link (copilot dot Microsoft dot com) with "/?q= &autorun=1*" after.

According to Varonis, prior to Microsoft's fix, the undocumented "?autorun=1" parameter could cause Copilot to automatically execute the embedded prompt when paired with a query parameter.

The attacker would send this link to the victim, and once the victim clicked, the embedded command could act within the victim's authenticated session and retrieve information from connected services like Gmail, Google Drive, Google Calendar, Copilot memory, and Copilot chat history. In addition to straight data exfiltration , a malicious prompt could also cause persistent memory poisoning, be used for reconnaissance, inject disinformation (to influence future prompts), and other malicious actions.

While the data exfiltration and memory poisoning aspects enabled by CoSnitch are notable, the most novel aspect of the research is the meta-hacking component. It's a reminder that prompt injection attacks remains a problem of the here and now.

Adar tells Dark Reading that even though the issue has been addressed by Microsoft, meta-hacking remains the most concerning element of the attack chain going forward. Varonis talked to Copilot and "it handed us the keys," the researcher says.

Even if this issue didn't impact enterprise customers in the traditional sense, these "personal" products could still have been hooked up to enterprise data, greatly expanding the potential blast radius.

"The specific vulnerabilities we found are in the Personal version, that's correct. But the person using Copilot Personal is the same person who walks into your office Monday morning," Adar explains. "They could have corporate emails forwarded to personal Gmail, credentials shared over personal accounts, work docs in a personal Drive. So when CoSnitch exfiltrates from a personal inbox, the data it pulls is often enterprise data. A stolen password from a personal account becomes a foothold in your corporate tenant."

He adds, however, that this isn't solely a Microsoft issue. The pattern of broad data access, assumed user intent, and a lack of separation between instructions and data continues to pops up across various vendors and products.

"Every enterprise AI assistant is a privileged insider with no security awareness and should be treated like one," Adar says. "Audit connectors, minimize access, and assume the trust boundary between legitimate and injected prompts will be broken."

Senior News Writer, Dark Reading

Alex is an award-winning writer, journalist, and podcast host based in Boston. After cutting his teeth writing for independent gaming publications as a teenager, he graduated from Emerson College in 2016 with a Bachelor of Science in journalism. He has previously been published on VentureFizz, Security, Nintendo World Report, and elsewhere.

At Dark Reading, he covers a variety of cybersecurity topics, including the cybercrime ecosystem, open source security, and the intersection between AI and threat actors. In his spare time, Alex hosts the weekly Nintendo podcast, "Talk Nintendo Podcast," and works on personal writing projects, including two previously self-published science fiction novels.

He has received numerous awards, including TechTarget's Writer of the Year in 2022 as well as more than 10 Azbee awards for his reporting between 2022 and today.

The State of Cloud Security: The Latest Challenges

How Organizations Are Managing Incident Response

How Enterprises Are Developing Secure Applications

Inside RSAC 2026: security leaders reveal the risks redefining your defense strategy

Essential News & Insights from Black Hat USA 2025

What Every Enterprise Should Know Securing Cloud Assets In the Age of AI

The Dos and Don'ts of a Cybersecurity Awareness Month People Actually Remember

Building a Secure AI Strategy for the Enterprise

Is your AppSec program Mythos Ready?

Experts Explain How to Develop a Framework for Cyber-Fraud Fusion