--- title: 'CoSnitch' Attack Tricked Copilot into Revealing Own... description: Varonis Threat Labs disclosed 'CoSnitch,' a meta-hacking technique that socially engineered Microsoft Copilot Personal into revealing details about its own... canonical: https://daily.dev/posts/cosnitch-attack-tricked-copilot-into-revealing-own-architecture-cdtn8reip twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: 'CoSnitch' Attack Tricked Copilot into Revealing Own Architecture | daily.dev og:description: Varonis Threat Labs disclosed 'CoSnitch,' a meta-hacking technique that socially engineered Microsoft Copilot Personal into revealing details about its own... og:url: https://daily.dev/posts/cosnitch-attack-tricked-copilot-into-revealing-own-architecture-cdtn8reip og:image: https://api.daily.dev/og/posts/CDTn8ReIP.png og:image:alt: 'CoSnitch' Attack Tricked Copilot into Revealing Own Architecture og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # 'CoSnitch' Attack Tricked Copilot into Revealing Own Architecture **[Dark Reading](https://daily.dev/sources/dr)** · 5 min read · 0 upvotes · 0 comments ## Summary Varonis Threat Labs disclosed 'CoSnitch,' a meta-hacking technique that socially engineered Microsoft Copilot Personal into revealing details about its own architecture, including an undocumented URL parameter (?autorun=1) that let attackers auto-execute malicious prompts without user interaction. Once triggered via a crafted link, the injected prompt could act within the victim's authenticated session, exfiltrating data from connected services like Gmail, Google Drive, and Copilot memory, and could also poison memory or inject disinformation. Microsoft assigned CVE-2026-24301 (CVSS 8.8), reported the issue was fixed on August 18, and said enterprise Copilot customers were unaffected since only Copilot Personal was impacted. Varonis reported the flaw in December 2025 and found no evidence of in-the-wild exploitation. Researchers warn the underlying meta-hacking pattern - AI assistants divulging their own security-relevant internals through conversation - remains a broader risk across vendors. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is the CoSnitch attack against Microsoft Copilot? CoSnitch is a vulnerability chain disclosed by Varonis Threat Labs in which researchers socially engineered Microsoft Copilot Personal into revealing its own architecture, including an undocumented URL parameter that auto-executed embedded prompts. A crafted link like copilot.microsoft.com/?q=&autorun=1 could run attacker prompts inside a victim's authenticated session without further interaction, enabling data theft and memory poisoning. _Teams securing AI assistants against prompt injection can track disclosures like this one on daily.dev._ ### Was the CoSnitch Copilot vulnerability patched, and does it affect enterprise customers? Yes, Microsoft shipped a fix on August 18 after Varonis reported the issue in December 2025 through coordinated disclosure, and assigned CVE-2026-24301 with a CVSS score of 8.8. Microsoft stated that only Copilot Personal was affected, enterprise customers were unaffected, and no customer action is required since the fix is already deployed. _Developers tracking AI assistant CVEs and patch timelines can follow updates like this on daily.dev._ ### How could the CoSnitch Copilot exploit exfiltrate data from a victim's account? An attacker sent a specially crafted Copilot link containing a malicious prompt and an undocumented autorun parameter; once the victim clicked it, the prompt executed automatically within their authenticated session, allowing retrieval of data from connected services like Gmail, Google Drive, Google Calendar, and Copilot's own memory and chat history, plus persistent memory poisoning and disinformation injection. _Anyone evaluating AI assistant attack surfaces can keep up with exploit writeups like this via daily.dev._ ## Similar posts on daily.dev - [Copilot 'SearchLeak' Attack Allows 1-Click Data Theft](https://daily.dev/posts/copilot-searchleak-attack-allows-1-click-data-theft-wrsuwvrwg) · Dark Reading · 0 upvotes · 0 comments - [Critical Copilot vulnerability allowed hackers to seal 2FA code from users](https://daily.dev/posts/critical-copilot-vulnerability-allowed-hackers-to-seal-2fa-code-from-users-ffggsogtl) · Ars Technica · 1 upvotes · 1 comments - [A single click on a Microsoft link could have drained your inbox. Here’s how SearchLeak worked.](https://daily.dev/posts/a-single-click-on-a-microsoft-link-could-have-drained-your-inbox-here-s-how-searchleak-worked--l731przby) · The Next Web · 0 upvotes · 0 comments - [New attack turned Microsoft 365 Copilot into 1-click data theft tool](https://daily.dev/posts/new-attack-turned-microsoft-365-copilot-into-1-click-data-theft-tool-ffqgdzkcx) · BleepingComputer · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#ai-security](https://daily.dev/tags/ai-security), [#prompt-injection](https://daily.dev/tags/prompt-injection), [#microsoft-copilot](https://daily.dev/tags/microsoft-copilot), [#data-exfiltration](https://daily.dev/tags/data-exfiltration) [View this post on daily.dev](https://daily.dev/posts/cosnitch-attack-tricked-copilot-into-revealing-own-architecture-cdtn8reip) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"'CoSnitch' Attack Tricked Copilot into Revealing Own Architecture","url":"https://daily.dev/posts/cosnitch-attack-tricked-copilot-into-revealing-own-architecture-cdtn8reip","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/cosnitch-attack-tricked-copilot-into-revealing-own-architecture-cdtn8reip"},"datePublished":"2026-08-18T20:31:43.158Z","dateModified":"2026-08-21T14:38:16.862Z","description":"Varonis Threat Labs disclosed 'CoSnitch,' a meta-hacking technique that socially engineered Microsoft Copilot Personal into revealing details about its own...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/2149c4f047fa3f40be1c98e1be63e29a?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/2149c4f047fa3f40be1c98e1be63e29a?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Dark Reading","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Dark Reading","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/dr","url":"https://daily.dev/sources/dr"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/cosnitch-attack-tricked-copilot-into-revealing-own-architecture-cdtn8reip","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,ai-security,prompt-injection,microsoft-copilot,data-exfiltration","timeRequired":"PT5M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Dark Reading","item":"https://daily.dev/sources/dr"},{"@type":"ListItem","position":3,"name":"'CoSnitch' Attack Tricked Copilot into Revealing Own Architecture"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/cosnitch-attack-tricked-copilot-into-revealing-own-architecture-cdtn8reip#faq","mainEntity":[{"@type":"Question","name":"What is the CoSnitch attack against Microsoft Copilot?","acceptedAnswer":{"@type":"Answer","text":"CoSnitch is a vulnerability chain disclosed by Varonis Threat Labs in which researchers socially engineered Microsoft Copilot Personal into revealing its own architecture, including an undocumented URL parameter that auto-executed embedded prompts. A crafted link like copilot.microsoft.com/?q=&autorun=1 could run attacker prompts inside a victim's authenticated session without further interaction, enabling data theft and memory poisoning. Teams securing AI assistants against prompt injection can track disclosures like this one on daily.dev."}},{"@type":"Question","name":"Was the CoSnitch Copilot vulnerability patched, and does it affect enterprise customers?","acceptedAnswer":{"@type":"Answer","text":"Yes, Microsoft shipped a fix on August 18 after Varonis reported the issue in December 2025 through coordinated disclosure, and assigned CVE-2026-24301 with a CVSS score of 8.8. Microsoft stated that only Copilot Personal was affected, enterprise customers were unaffected, and no customer action is required since the fix is already deployed. Developers tracking AI assistant CVEs and patch timelines can follow updates like this on daily.dev."}},{"@type":"Question","name":"How could the CoSnitch Copilot exploit exfiltrate data from a victim's account?","acceptedAnswer":{"@type":"Answer","text":"An attacker sent a specially crafted Copilot link containing a malicious prompt and an undocumented autorun parameter; once the victim clicked it, the prompt executed automatically within their authenticated session, allowing retrieval of data from connected services like Gmail, Google Drive, Google Calendar, and Copilot's own memory and chat history, plus persistent memory poisoning and disinformation injection. Anyone evaluating AI assistant attack surfaces can keep up with exploit writeups like this via daily.dev."}}]} ```