CoSnitch turned Copilot into a gateway for data theft

What this is about

Varonis Threat Labs disclosed an attack chain against Microsoft Copilot Personal on August 18, 2026. The researchers call it CoSnitch. According to their report, one click on a crafted link was enough for Copilot to execute an injected prompt without visible confirmation. The assistant could then query data from connected services, send information to an external server, and even alter its persistent memory.

Varonis reported the vulnerabilities to Microsoft in December 2025. The primary source says fixes shipped on August 18, 2026. The researchers say they found no evidence of exploitation in the wild. That distinction matters: CoSnitch is a demonstrated technical chain, not a reported mass attack.

What CoSnitch actually does

The chain combined three weaknesses. First, an attacker could prepare a prompt through a URL parameter. Together with the undocumented autorun=1 parameter, that prompt executed automatically when the page opened. Second, Copilot's ability to retrieve web addresses could be abused for data exfiltration. A prompt could pull information from connected accounts, place it inside a URL, and thereby send it to a controlled web server.

Third, the researchers described persistent poisoning of Copilot's memory. When Copilot summarized a crafted webpage, instructions could be written into the assistant's memory. Varonis says the manipulation survived password changes, session revocation, and device re-enrollment.

The discovery method is unusual as well. The researchers repeatedly asked Copilot why automatic prompt execution was supposedly impossible. In its explanations, the system gradually revealed internal parameters and protections. Varonis calls this “meta-hacking”: not only the interface, but the model's willingness to explain itself became a source of security information.

Why it matters

An assistant with access to email, calendars, files, and chat history concentrates many permissions in one place. A successful prompt-injection attack can therefore reach farther than an ordinary malicious link. It does not need to crack a password if the signed-in assistant is already allowed to read the data on the user's behalf.

CoSnitch also illustrates a structural problem: language models do not reliably separate data from instructions. Text from a webpage or file can be both content and a hidden command. That is why traditional warnings about suspicious downloads are insufficient. Organizations must also review which sources an assistant may read, which actions it can perform automatically, and which outbound connections are permitted.

For consumers, the practical lesson is simple: even a link to a familiar domain is not automatically safe. What matters is which parameters the link contains and which connected accounts the assistant can reach in the background.

In plain language

CoSnitch is like a hotel guest repeatedly asking a concierge why a locked back door is impossible to open. The concierge explains so much about keys, alarms, and staff routes that the guest eventually learns the correct entrance. The guest then uses the concierge's access rights, rather than personal keys, to reach several rooms.

A practical example

An employee uses Copilot Personal with access to Gmail and Google Drive. She receives a message containing a link that looks like a normal Copilot page and clicks it. In her already authenticated browser, the link starts an injected prompt. It searches for the newest file with “credentials” in its name and causes Copilot to send part of the content to an external server through a crafted URL.

The employee sees no separate confirmation for the prompt. Even if only one out of 100 recipients clicks, one successful interaction could expose data from a connected account. This example is fictional; it mirrors the technical chain described by Varonis and is not evidence of a real incident.

Scope and limits

• Microsoft patched the reported attack chain on August 18, 2026, according to Varonis. The published procedure therefore does not describe a known standard route that remains open.
• Varonis says it observed no exploitation in the wild. The number of potential victims and any real-world damage are unknown.
• The research concerns Copilot Personal and specific integrations. Its findings cannot automatically be transferred to every Copilot edition or every other assistant.
• A patch does not eliminate the wider prompt-injection problem. Organizations still need least privilege, restricted connectors, outbound filtering, and visible confirmation before sensitive actions.

SEO & GEO keywords

CoSnitch, Microsoft Copilot Personal, Varonis Threat Labs, prompt injection, data exfiltration, memory poisoning, autorun, AI security, connected apps, one-click attack