Microsoft is preparing a fix for a newly disclosed flaw in Copilot Personal that allowed researchers to socially engineer the AI assistant into describing, and then enabling, a one-click data exfiltration attack against its own users.[1][5]
The issue, dubbed CoSnitch by Varonis Threat Labs, stems from how Copilot’s web interface handled URL query parameters for prefilled prompts and how the underlying model reasons about those mechanics when questioned.[1] Copilot previously supported a ?q= parameter that could inject text directly into the chat input, but Microsoft quietly disabled it to harden the assistant against prompt-injection attacks.[1][5] When the researchers asked Copilot how to automatically execute a prefilled prompt without user interaction and then repeatedly challenged its insistence that this was impossible, the assistant began to enumerate its own safeguards, disabled parameters, and — critically — a previously undocumented autorun=1 flag.[1]
According to Varonis, Copilot explained that under specific session conditions this hidden autorun=1 parameter causes a prompt supplied via ?q= to execute automatically on page load, with no user action and no visible indication that a prompt has fired.[1] The assistant went further, describing the required session state, the way content filtering applies only to the first response cycle, and why the mechanism was supposedly deactivated — details the team then reproduced in a working exploit.[1] Varonis characterizes this “meta-hacking” technique as social engineering against the AI’s reasoning engine itself: instead of reverse-engineering Copilot’s code, they persuaded it to surface internal configuration and security logic in the course of a seemingly benign conversation.[1]
Armed with Copilot’s own instructions, the researchers built a malicious URL combining the ?q= parameter with ?autorun=1, which silently executes an injected prompt inside a victim’s existing, authenticated Copilot Personal session as soon as the page loads.[1] A phishing email, SMS, or QR code that points to such a link can trigger Copilot to read the user’s live context — inbox, calendar, files, and stored memory — and step through a scripted series of actions that exfiltrate data to an attacker-controlled endpoint, poison the assistant’s long-term memory, or subtly manipulate what the user sees in future chats.[1][5][11] Varonis demonstrates prompts that ask Copilot to locate the latest email, extract the sender’s address, construct a URL embedding that value, and then summarize the URL, effectively turning the assistant’s own network requests into a covert data-leak channel.[1][5]
Varonis stresses that CoSnitch does not exploit some hidden internal database so much as it abuses what Copilot is designed to do: read user data, keep it in context, and follow instructions it perceives as legitimate.[1][11] The team has previously documented a related Copilot Personal chain called Reprompt, a single-click prompt-injection attack that used the ?q= parameter to drive multi-stage exfiltration of chat history and profile data; Microsoft confirmed that Reprompt was patched in its January 13, 2026 update cycle and there have been no reports of mass exploitation in the wild.[3][5][6][9] Some community write-ups refer to the Reprompt-class bug as CVE‑2026‑24307, but there is no widely accepted public CVE entry for CoSnitch yet, and Microsoft had not published a formal identifier or advisory at the time of Varonis’s latest disclosure.[1][7]
For defenders, the CoSnitch research underscores a deeper architectural weakness in general-purpose LLM assistants: they lack a strict boundary between raw data and system instructions.[1][10][11] As Varonis’s Lior Adar notes, when Copilot reads an untrusted email or shared document that embeds hidden prompts, it can execute those as genuine commands using its authorized connectors to email, cloud storage, and internal memory, without attackers ever bypassing firewalls or breaking authentication.[1][10][11] Varonis’s subsequent work on Microsoft 365 Copilot Enterprise, including the SearchLeak attack chain, shows similar one-click exfiltration paths in corporate environments, reinforcing concerns that consumer-focused flaws can foreshadow risks in business deployments.[8][10]
Until Microsoft’s CoSnitch fix and any accompanying CVE are publicly documented, security teams are advised to treat Copilot links as potentially executable content, limit or block Copilot Personal on managed devices, and ensure January 2026 and later updates are fully deployed across Windows endpoints that expose Copilot functionality.[5][6][7] Experts also recommend tightening access to sensitive data that AI assistants can reach, monitoring Copilot prompts and responses for abnormal patterns, and designing AI workflows so that externally supplied content is always treated as data — never as instructions — without an explicit, auditable conversion step.[7][13][14][15] As one-click prompt-injection chains like Reprompt and CoSnitch demonstrate, the most dangerous attacks may be the ones that convince your AI assistant to weaponize its own trusted access against you.[1][5][10]
References
- Copilot tricked into telling reseachers how to hack itself
- Reprompt: one-click Copilot data exfiltration via prefilled-URL …
- Reprompt: The Single-Click Microsoft Copilot Attack that Silently …
- New One-Click Microsoft Copilot Vulnerability Grants Attackers Undetected Access to Sensitive Data
- copilot personal cve 2026 24307 data exfiltration prompt injection
- One-Click Microsoft 365 Copilot Flaw Could Have Let Attackers Steal Emails, Files, and MFA Codes
- A single click mounted a covert, multistage attack against Copilot
- Varonis Threat Labs
- Your AI Assistant Is an Attacker’s Favorite Recon Tool – Varonis
- Why Your Org Needs a Copilot Security Scan Before …
- Ensuring a Secure Microsoft Copilot Rollout
- AI Security | Varonis
