www.it-connect.fr
CoSnitch: Copilot Exposed the Hidden URL Flaw Used to Steal Data
Varonis researchers identified 3 vulnerabilities in Copilot, Microsoft’s AI assistant. The result was an attack named CoSnitch, with one unusual twist: Copilot itself revealed the undocumented URL parameter that made the exploit possible. Microsoft patched the vulnerability on August 18, 2026. Here’s what we know.
Meta-hacking: how Copilot exposed its own architecture
It all started with a question asked to the consumer version of Copilot at copilot.microsoft.com: can a prompt be run without user action? Copilot said no. But each refusal came with a technical explanation. The researchers kept pressing, rephrasing each answer into another question to learn more about URL structure, deep links, and pages loaded with a prefilled field. After a while, Copilot finally disclosed an undocumented parameter: autorun=1 and the safeguards meant to neutralize it.
They rebuilt the URL exactly as described by the AI, and it worked. Varonis calls this meta-hacking, essentially social engineering applied to the reasoning engine itself. "Copilot wasn’t compromised; it was manipulated", the Varonis researchers said. In fact, Copilot itself gave the researchers the keys—some might say it simply yielded under pressure.
Three chained flaws that enabled one-click data theft
Behind the CoSnitch name are actually three separate security issues, and using them together made it possible to steal data in a single click.
- Automatic prompt execution. The
qparameter only prefilled the input field. Combined withautorun=1, it triggered execution as soon as the page loaded, in the victim’s authenticated session. And according to Varonis, the prompt ran in full even if the tab was closed immediately. - Exfiltration via OAuth connectors. The prompt queried the services the user had authorized, encoded the results in base64, then sent them to a remote webhook by abusing Copilot’s native ability to fetch a web page.
- Persistent memory poisoning. A booby-trapped page summarized by Copilot caused the assistant to store attacker-chosen instructions in its long-term memory.
Here is an example URL corresponding to the first step:
https://copilot.microsoft.com/?q=<malicious_prompt>&autorun=1*During their tests, the researchers say they were able to retrieve:
- Email body text, subjects, and metadata from connected mailboxes
- Calendar event titles, attendees, times, and locations
- File names and metadata summaries from Google Drive
- The full content of previous Copilot conversations
- Items stored in persistent memory, including user-defined rules
These tests highlight the risks tied to AI conversation history, but even more so the risks tied to connected third-party services. This was not a flaw in Google Drive or Gmail: Copilot simply accessed content from an account it already had access to. It was authorized to use those permissions, legitimately. Most importantly, this attack requires only one click: if the victim clicks the link crafted by the attacker, it’s game over.
"CoSnitch combines three vulnerabilities, one click, and zero abnormal signals. Each vulnerability is serious on its own. Chained together, they turn a simple click into a silent data theft tool by exploiting the trust model at the heart of modern AI connectivity, without hacking anything," the researchers explained.
The security fix developed by Microsoft
Varonis reported the security flaw to Microsoft in December 2025. Microsoft’s fix, however, was only recently rolled out: August 18, 2026.
The Redmond company also added this vulnerability to its database under the identifier CVE-2026-24301, with a CVSS 3.1 score of 8.8 out of 10. The key point is that you do not need to do anything: this is a server-side fix applied by Microsoft. It also appears that this flaw affects only the consumer version of Copilot, not the version used through Microsoft 365.
What Microsoft does not specify, however, is whether the patch cleans up the user’s memory if it was altered by an attack based on this technique. The reassuring point is that this method does not appear to have been exploited in the wild, even though it remained unpatched for 8 months.
CoSnitch is the third Copilot flaw reported by Varonis this year, after Reprompt and SearchLeak, which turned Copilot Enterprise into a one-click data theft tool. If you want to learn more, read the Varonis report.
