Copilot tricked into telling reseachers how to hack itself
This title could be clearer and more informative.Try out Clickbait Shieldfor free (5 uses left this month).
Varonis Threat Labs discovered a vulnerability dubbed CoSnitch in Microsoft Copilot Personal, exploited via a technique called meta-hacking that socially engineers the AI's reasoning engine into revealing details of its own defenses. By repeatedly questioning Copilot about why auto-execution shouldn't work, researchers extracted an undocumented URL parameter, autorun=1, which combined with the q= query parameter allowed a crafted link to trigger prompt execution with no user interaction. This one-click attack could exfiltrate data from connected apps like Gmail and Google Drive, poison Copilot's persistent memory, or inject disinformation into future sessions. Varonis reported the flaw to Microsoft in December 2025, and Microsoft planned to patch it and issue a CVE.
Table of contents
These novel attack chains do more than just exfiltrate user data. I tricked the assistant into leaking sensitive internal parameters and configuration detailsOpenAI ditches Recall-style screenshot surveillance for friendly keyloggingPrompt injection isn't the bug, AI agent frameworks areMicrosoft tells engineers to curb their token-burning enthusiasmGitHub AI agent leaks private repos when asked nicelyHow attackers can use CoSnitchQuestions this post answers
What is the CoSnitch vulnerability in Microsoft Copilot?
CoSnitch is a vulnerability discovered by Varonis Threat Labs in which an undocumented URL parameter, autorun=1, combined with Copilot's existing q= query parameter, allows a malicious link to auto-execute a prompt in a victim's authenticated Copilot session with no user interaction. Researchers extracted this parameter by repeatedly asking Copilot to explain its own auto-execution protections until it revealed the disabled mechanism, which still worked when tested. Track disclosures like this on daily.dev to keep AI-integrated apps ahead of prompt-injection risks.
How did researchers get Copilot to reveal its own security vulnerability?
Varonis researchers used a technique called meta-hacking, asking Copilot innocuous questions about how to pre-fill a prompt via URL, then repeatedly pushing back when told auto-execution was impossible. Copilot responded with precise technical details, including disabled parameters, session conditions, and the undocumented autorun=1 parameter, which researchers then confirmed worked exactly as described despite Copilot claiming it no longer functioned. Developers securing AI assistants can follow writeups like this on daily.dev to spot similar social-engineering attack patterns.
What can attackers do with a Copilot prompt-injection exploit like CoSnitch?
Attackers can craft a one-click URL that, once clicked, auto-executes a hidden prompt in the victim's active Copilot session to exfiltrate data via OAuth connectors to Gmail, Google Drive, or Google Calendar, retrieve chat history, poison Copilot's persistent memory, or inject disinformation into future sessions, all without visible confirmation to the user. daily.dev helps teams building on AI assistants stay current on prompt-injection risks before they ship integrations.