Microsoft Copilot Told Researchers How to Hack Itself
Researchers kept asking Copilot why an attack would not work. Eventually, the AI disclosed the undocumented mechanism they needed to make it work.
Published:
Estimated reading time: 8 minutes
Microsoft Copilot has joined the growing list of AI assistants compromised through prompt injection. What makes this case considerably more interesting is how researchers found the vulnerability.
They asked Copilot.
Security researchers at Varonis discovered a vulnerability they named CoSnitch, tracked as CVE-2026-24301, that could cause Microsoft Copilot to automatically execute attacker-supplied instructions after a victim clicked a specially crafted link. Those instructions could then use access already granted to Copilot to retrieve information from connected services and send that information outside the user’s account.
Microsoft shipped comprehensive fixes on August 18, 2026. Varonis says it disclosed the problem to Microsoft in December 2025 and has found no evidence that CoSnitch was exploited in the wild.
But the vulnerability itself may not be the most important part of the story.
The researchers say Copilot essentially helped them discover it.
Asking the System How Its Own Defenses Work
Varonis researchers initially wanted to determine whether an attacker could make Copilot execute a prompt automatically when someone opened a link.
Copilot told them it could not be done.
The assistant explained that user intent was required and that a person would still have to perform an action before a prompt could execute. Instead of accepting that answer, the researchers kept asking why.
They questioned Copilot about URL structures, deep links, pre-filled prompts and the mechanisms preventing those prompts from executing automatically.
Each refusal provided another piece of information about the system.
According to Varonis’s technical account, Copilot eventually disclosed an undocumented URL parameter associated with automatic prompt execution, including information about how the mechanism had previously behaved and what protections were supposed to prevent its abuse.
The researchers tried what Copilot had described.
It worked.
Varonis calls the technique meta-hacking: rather than reverse-engineering an application in the traditional sense, researchers interrogated the AI about the architecture and restrictions surrounding itself.
That creates a peculiar new security problem.
A conventional application normally does not explain its own undocumented attack surface to whoever happens to ask the right sequence of questions. An AI system capable of reasoning about its environment potentially can.
One Click Was Enough
The underlying weakness involved the way Copilot handled parameters embedded in a URL.
One parameter, ?q=, could place text into Copilot’s prompt field. Normally, that alone was not particularly dangerous because the user still needed to submit the prompt.
The undocumented ?autorun=1 mechanism discovered by the researchers changed that behavior. Combined with the pre-filled prompt, it allowed instructions to execute automatically when the Copilot page loaded.
The victim still had to click the malicious link, but after that, no additional approval was required.
Because the browser opened Copilot inside the victim’s authenticated session, the injected instructions ran with whatever access that user had already granted to Copilot. Varonis demonstrated access to connected services including Gmail, Google Drive, Google Calendar and OneDrive, as well as Copilot’s own chat history.
That distinction matters.
The attack did not somehow break Gmail encryption or steal an OAuth token directly. Copilot was legitimately authorized to read the information.
The vulnerability allowed an attacker to silently tell Copilot to exercise that legitimate access.
In other words, the problem was not necessarily that Copilot had too much access. The problem was that the system could be tricked into treating an attacker’s instructions as though they came from the authenticated user.
Turning an AI Feature Into an Exfiltration Channel
Once malicious instructions were running, the researchers demonstrated another problem.
Copilot can retrieve outside webpages when asked to summarize or examine a URL. That seemingly ordinary AI feature provided a potential path for data to leave the system.
An injected prompt could retrieve information available through a connected account, transform that information into data that could be placed inside a URL, and then instruct Copilot to access an attacker-controlled address containing that data.
The outbound web request delivered the information.
Varonis demonstrated the technique using test data that included email content and credentials. The researchers also said the same approach could potentially target files, calendar information, Copilot conversation history and other data available to the assistant.
This is one reason AI assistants change the security equation.
A traditional chatbot that can only generate text presents one class of risk. An AI assistant connected to email, cloud storage, calendars, web access and other applications is something else entirely.
Every useful capability becomes another capability an attacker may attempt to redirect.
CoSnitch Went Beyond Stealing Data
Varonis also discovered a second attack involving Copilot’s persistent memory.
A malicious webpage could contain hidden instructions. If a user asked Copilot to summarize that page, those instructions could attempt to alter information stored in Copilot’s long-term memory.
That opens the possibility of an AI assistant carrying attacker-controlled instructions from one session into another.
According to the researchers, poisoned memory could survive password changes, session revocation and device re-enrollment because the unwanted information was stored as part of Copilot’s persistent memory rather than as a conventional compromised login session.
That is a very different persistence mechanism from malware installing itself on a computer.
The compromised component is effectively part of what the AI believes it should remember.
Microsoft Has Fixed the Vulnerability
Microsoft began mitigating parts of the attack months before Varonis publicly disclosed it and released broader fixes on August 18.
Microsoft told Ars Technica that customers are protected and do not need to take action, adding that it continues to update its guardrails against similar techniques.
Varonis likewise states that it has found no evidence CoSnitch was exploited outside its research environment.
So this is not a warning that someone can currently copy the researchers’ technique and begin emptying Copilot users’ inboxes.
The interesting part is what the vulnerability reveals about AI security.
The Bigger Problem Is Not This Particular Parameter
Microsoft can disable a URL parameter. It can require additional confirmation before sensitive actions. It can add filters around external network requests.
Those fixes address CoSnitch.
They do not eliminate the broader problem that created it.
An AI assistant increasingly sits between the user and a collection of privileged systems. We ask it to read email, search private documents, inspect calendars, interact with websites and remember information across conversations.
At the same time, the assistant accepts instructions expressed in ordinary language from numerous sources.
That creates an enormous trust problem: Which instructions belong to the user, and which merely look like they do?
CoSnitch makes that problem even stranger because the AI reportedly helped researchers map the protections surrounding itself.
The researchers did not simply discover that a guardrail could be bypassed.
They persuaded the system behind the guardrail to explain enough about the guardrail that they could figure out how to bypass it.
As AI agents receive more access to computers, accounts and corporate systems, that may become an increasingly important security assumption to reconsider.
It is not enough to ask whether an AI will refuse a dangerous command.
We may also need to ask what the AI reveals while explaining why it refused.