What CoSnitch chained together
Nothing in the chain breaks Microsoft's code. What it uses is reach: one assistant now holds your mail, files, calendars, and chat, so it only has to be tricked once. Varonis frames it as a sequence that walks data out of a company while never tripping anything that looks like an alarm.
Three flaws, one click
None of the three is the whole attack. They have to line up in order.
| Stage | Flaw | What it does |
|---|---|---|
| 1 | Automatic prompt execution | ?q= combined with an undocumented parameter runs an attacker-supplied prompt the moment the page loads |
| 2 | Exfiltration to an external server | The injected prompt queries the connected apps, encodes the results into a URL, and fetches it |
| 3 | Persistent memory poisoning | Summarizing a crafted page writes the attacker's instructions into the victim's permanent memory |
Stage three is the one that outlives the incident. The instruction it plants survives password changes, session revocation, and device re-enrollment.
"Varonis Threat Labs uncovered another one-click vulnerability in Microsoft Copilot Personal dubbed CoSnitch (critical, CVE-2026-24301), which quietly executes an attack chain that exfiltrates data from enterprises without obvious red flags."／"Automatic prompt execution: The ?q= URL parameter combined with an undocumented parameter causes any attacker-supplied prompt to execute instantly on page load: no click, no confirmation, no user action. One link is all it takes."／"Data exfiltration to external servers: An injected prompt can query the victim's connected apps (Gmail, Drive, Calendar, OneDrive), encode the results into a URL, and exfiltrate them via Copilot's built-in URL-fetch capability to an attacker-controlled webhook."／"Persistent memory poisoning via web summarization: A crafted webpage, when summarized by Copilot, injects attacker instructions into the victim's permanent memory store. The injection survives password changes, session revocation, and device re-enrollment, persisting forever." (intro / The vulnerabilities behind CoSnitch) — from Varonis Threat LabsView official source →
The patch took eight months to arrive
Varonis reported the chain to Microsoft in December 2025 and the patch arrived on August 18, 2026. The company says it has seen no sign of exploitation in the wild. CoSnitch is also the third Copilot flaw Varonis Threat Labs has discovered this year. Reprompt got past the guardrails simply by asking twice; SearchLeak turned Microsoft 365 Copilot Enterprise into a silent exfiltration path. All three end in the same place: one click on a link that looks legitimate.
"CoSnitch is the third Microsoft Copilot flaw Varonis Threat Labs has discovered this year. Reprompt bypassed Copilot's guardrails just by asking twice. SearchLeak turned Microsoft 365 Copilot Enterprise into a silent exfiltration tool. All three share the same pattern: one click on a legitimate-looking link is enough."／"Varonis disclosed CoSnitch to Microsoft in December 2025, and patches were shipped on August 18, 2026. Varonis has seen no evidence that the attack has been exploited in the wild, and thanks Microsoft for their collaboration on the fix." (intro) — from Varonis Threat LabsView official source →
The researchers asked Copilot how to break it
What sets CoSnitch apart is less the flaw than the route to it. Nobody reverse-engineered anything. The AI handed over the weakness during ordinary use, in a pattern Varonis calls meta-hacking.
Refusals as raw material
The first question — is there a way to run a prompt with no user interaction — got a clean refusal. That is not how it works, Copilot said. User intent is required, prompts do not fire on their own.
The researchers treated the refusal as material. They reframed each follow-up so it read as curiosity rather than probing, and worked through URL structure, deep links, and what happens when a page loads with text already sitting in the input field. Each question was built to push the model one level further into describing how it is put together, and every answer narrowed what was left to try.
Varonis puts it plainly: the resistance is part of the technique. You go after the "because" in "that won't work, because." You are not exploiting the model. You are talking it into helping.
"Our researchers didn't have to reverse-engineer the flaw. The AI exposed the weakness during normal use"／"When we first asked Copilot how to execute a prompt without user interaction automatically, it explained that’s not how it works, user intent is required, and prompts don’t fire on their own."／"Instead of settling for that standard response, we deliberately kept pushing by reframing each question to seem like a natural follow-up rather than a probe. We asked about URL structure, deep links, and what happens when a page is loaded with input already in the field with the intent to make Copilot reason one layer deeper about its own architecture. Every answer narrowed our search. This is called meta-hacking, aka social engineering the reasoning engine itself. The resistance is part of the technique."／"You don’t exploit the model. You manipulate it into cooperating." (Meta-hacking: How we got Copilot to snitch on itself) — from Varonis Threat LabsView official source →
Copilot named the undocumented parameter itself
The decisive detail came out of Copilot's own mouth. Mid-refusal, unprompted, it disclosed an undocumented URL parameter — along with how that parameter used to behave and every protection that had been added to disable it.
The researchers assembled the URL exactly as described, and the prompt executed with no click and no confirmation. ?q= on its own only pre-fills the input box and still waits for Enter. ?autorun=1 is what turns on execution at page load, and the attack needs both to run in silence. Once execution fires, the prompt carries the same capabilities as anything the user typed.
"Once execution is triggered, the prompt has the same capabilities as any legitimate user instruction."／"Copilot then disclosed an undocumented URL parameter — unprompted, mid-refusal — including its historical behavior and every protection put in place to disable it"／"We built the URL exactly as described. With no click or confirmation from the user, the prompt was successfully executed automatically"／"Note: ?q= alone only pre-fills the input the user would still need to press Enter. It is ?autorun=1 that enables automatic execution on page load. Both parameters must be present for the attack to work silently." (The steps behind meta-hacking / Vulnerability 1: Automatic prompt execution) — from Varonis Threat LabsView official source →
The whole inbox goes out, and the memory never clears
After that the question is only what to ask for.
Copilot prompt injection with full OAuth reach
If the victim has connected Gmail, Copilot can read the inbox — not summaries, not metadata, but full message bodies, because the OAuth grant handed it permission to read mail on the user's behalf. Varonis found credentials shared over email, internal system passwords, password reset links, and personal information nobody had treated as sensitive because it was "just in email."
What left the machine during Varonis's testing
| Source | What was taken |
|---|---|
| Gmail / Outlook | Message bodies, subject lines, sender and recipient metadata |
| Google Calendar | Meeting names, attendees, times, locations |
| Google Drive | File names and metadata summaries |
| Copilot chat history | The full contents of past conversations |
| Copilot memory | Cross-session context, stored instructions, user-defined rules |
The collected data is base64-encoded into the path of a URL, and Copilot's own URL-fetch capability sends it to a webhook the attacker controls. On the network, that looks exactly like Copilot summarizing a web page. No anomalous headers, no unusual ports, nothing in the payload to flag. Security tooling sees Copilot doing what Copilot always does.
"Once Copilot has OAuth access to a user’s Gmail account, it can read everything in that inbox, not summaries, not metadata, but full message bodies. In our testing, this included emails containing credentials shared over email, internal system passwords, password reset links, and sensitive personal information that users had never considered at risk because it was “just in email.”"／"the prompt instructs Copilot to encode the collected data into a URL path and fetch it"／"The base64 encoding compresses the payload into a URL-safe string and helps avoid triggering content filters that scan for sensitive patterns, such as passwords or API keys, in outbound requests."／"For multi-source exfiltration, retrieved content is concatenated into a single encoded payload"／"Email content, subject lines, sender/recipient metadata, message bodies"／"Google Calendar Meeting titles, attendees, times, and locations"／"Google Drive File names, metadata summaries"／"Copilot Chat History Full prior conversation content"／"Copilot Memory Persistent cross-session context, saved instructions, user-defined rules"／"From the network layer, this is a standard outbound HTTPS GET request, identical to any legitimate URL fetch Copilot performs when summarizing a webpage. No anomalous headers, no unusual ports, no flaggable payload. Security tooling sees Copilot doing exactly what it always does: fetching a URL." (Vulnerability 2; each row of the table above comes from a cell of the Data exfiltrated in testing table in that section) — from Varonis Threat LabsView official source →
Indirect prompt injection writes to Copilot memory
The third flaw arrives from a different direction. The instruction is not typed by the victim; it is planted in a page the model is asked to read, which is what indirect prompt injection means. Ask Copilot to summarize the crafted page, and the instructions hidden in its HTML enter the same context as the text to be summarized. Copilot does not separate content to summarize from instructions to follow, so the instruction runs and lands in the permanent memory store. The summary that comes back looks entirely normal.
From there it does not expire. It does not reset between sessions, it does not clear on logout, and nothing deletes or overwrites it automatically. Every later conversation runs inside the attacker's context until the user opens the memory settings and removes it by hand — and Varonis notes that many users do not know the memory exists at all.
There is also nothing to investigate afterward. The memory write produces no process, no file, no network connection, and no log entry. The only record is the memory screen itself. Poisoned AI memory has surfaced in other products too, covered in the self-replicating AI worm in Word documents and the Snowflake flaw an AI exploited in five days.
The delivery vehicle is a single link, and Varonis lists QR codes alongside email and chat as ways to hand it over. Checking what a code resolves to before opening it stops the chain at the first step.
"Copilot does not distinguish between content to summarize and instructions to follow when processing external page content. If the page contains natural language instructions formatted in a way the model interprets as directives, those instructions execute."／"The victim clicks the attacker’s crafted URL (delivered via email, chat, phishing page, QR code, etc.)"／"Once the memory is written, the attacker’s instructions are permanent. Copilot’s memory has no expiration. It does not reset between sessions and does not clear on logout, and is never automatically deleted or overwritten. The injected instruction remains active in every future Copilot conversation for that user unless the user manually navigates to the memory settings and deletes it. Most users never do this, with many users not even knowing it exists."／"No forensic footprint: The memory write produces no process, file, network connection, or log entry that security tooling would flag. The only record is in Copilot’s memory UI, which users rarely inspect" (Vulnerability 3: Indirect prompt injection via web summarization → persistent memory modification / Impact: Unauthorized memory modification; the QR-code fragment is from Vulnerability 1: Automatic prompt execution) — from Varonis Threat LabsView official source →
What CoSnitch means for agent platforms
Three vulnerabilities, one click, zero anomalous signals. Automatic prompt execution, exfiltration through the connected apps, and a summary that writes into permanent memory. Each is serious alone; chained, they turn one click into a silent data-theft tool by using the trust model of modern AI connectivity rather than breaking anything. The patch shipped on August 18, 2026, and no exploitation in the wild has been observed. What does not get patched is the discovery method. Varonis expects meta-hacking — using a model's own reasoning to surface its hidden internals — to apply to any agentic platform with a natural language interface.
"CoSnitch is three vulnerabilities, one click, and zero anomalous signals. Each vulnerability poses a serious risk on its own. Chained together, they turn a single click into a silent data-theft tool by exploiting the trust model at the heart of modern AI connectivity, not by breaking anything."／"The novel meta-hacking technique that uncovered CoSnitch — using the AI’s own reasoning to surface its hidden internals — applies to any agentic platform with a natural language interface." (The bottom line) — from Varonis Threat LabsView official source →
