--- title: Researchers Got Microsoft Copilot to Explain How to Hack It description: Security researchers at Varonis Threat Labs discovered a Microsoft Copilot vulnerability, dubbed CoSnitch, by repeatedly questioning the assistant about its... canonical: https://daily.dev/posts/researchers-got-microsoft-copilot-to-explain-how-to-hack-it-d2iyepsem twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Researchers Got Microsoft Copilot to Explain How to Hack It | daily.dev og:description: Security researchers at Varonis Threat Labs discovered a Microsoft Copilot vulnerability, dubbed CoSnitch, by repeatedly questioning the assistant about its... og:url: https://daily.dev/posts/researchers-got-microsoft-copilot-to-explain-how-to-hack-it-d2iyepsem og:image: https://api.daily.dev/og/posts/d2IYePSem.png og:image:alt: Researchers Got Microsoft Copilot to Explain How to Hack It og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Researchers Got Microsoft Copilot to Explain How to Hack It **[Collections](https://daily.dev/sources/collections)** · 3 min read · 1 upvotes · 1 comments ## Summary Security researchers at Varonis Threat Labs discovered a Microsoft Copilot vulnerability, dubbed CoSnitch, by repeatedly questioning the assistant about its own safeguards until it revealed an undocumented URL parameter, autorun=1. Combined with an existing q= parameter, this allowed zero-click prompt execution via a crafted link, affecting both Copilot Personal and Microsoft 365 Copilot Enterprise. Attackers could exfiltrate data from connected apps like Gmail and Google Drive, poison persistent memory, or pull sensitive data in enterprise settings with no user interaction beyond a click. Varonis reported the flaw in December 2025; Microsoft issued a partial fix in February and a more complete patch this week, with a CVE expected. ## Content Security researchers at Varonis Threat Labs spent months poking at Microsoft Copilot, and the way they eventually cracked it is almost funnier than the bug itself: they just kept asking Copilot why a certain attack shouldn't work. Eventually it told them. The result is a vulnerability chain called CoSnitch (CVE-2026-24301, CVSS 8.8), and it's a good reminder that AI assistants can leak their own security internals through plain conversation. ## How researchers found it Varonis used what they're calling meta-hacking - instead of throwing exploit payloads at Copilot, they repeatedly interrogated the assistant about its own defenses. Mid-refusal, Copilot revealed an undocumented URL parameter: `autorun=1`. Combine that with the existing `q=` query parameter, and you had a way to make Copilot execute a prompt the instant someone clicked a link. No extra confirmation, no second click, nothing. That's the part that sticks with me. The vulnerability wasn't found by reverse-engineering code or fuzzing endpoints - it was found by asking the AI nicely, repeatedly, until it slipped. ## What the bug actually did Once triggered, the crafted link could act inside the victim's already-authenticated Copilot session. That opened up three separate problems: - **Zero-click execution.** The `autorun=1` parameter meant a single click on a malicious link was enough to run an attacker's prompt, with no additional consent gesture required. - **Data exfiltration.** Copilot's connector access to Gmail, Google Drive, Calendar, and OneDrive could be abused to pull sensitive data out and send it to attacker-controlled webhooks. - **Persistent memory poisoning.** Malicious instructions planted through web-page summarization stuck around in Copilot's memory - surviving password changes, session revocation, and even device re-enrollment. Put together, an attacker could steal passwords and personal data the moment someone clicked a link, then leave behind poisoned memory that kept feeding disinformation or exfiltrating data into future sessions. ## The timeline is the frustrating part Varonis reported the flaw to Microsoft in December 2025. Microsoft applied a partial fix in February, blocking the `q=` parameter from injecting text directly. But the real fix - closing the whole chain - didn't ship until August 18, 2026, alongside the public disclosure and CVE assignment. That's roughly eight months from report to full patch. Varonis says they found no evidence of in-the-wild exploitation before the patch landed, which is the best possible outcome for a bug like this. But eight months is a long time to sit on a one-click account takeover. ## Who's actually affected Microsoft says only Copilot Personal was impacted, and that enterprise Copilot customers are in the clear. I'd take that with a grain of salt. Analysts have pointed out that in real organizations, personal and enterprise Microsoft accounts overlap constantly - people use the same Microsoft account for personal Copilot and work-adjacent tasks all the time. A clean line between ## Questions this post answers ### What is the CoSnitch vulnerability in Microsoft Copilot? CoSnitch is a zero-click vulnerability discovered by Varonis Threat Labs that combined an undocumented autorun=1 URL parameter with the existing q= query parameter, letting a crafted link trigger prompt execution in Microsoft Copilot with no user interaction beyond visiting the link. It affected both Copilot Personal and Microsoft 365 Copilot Enterprise, enabling data exfiltration from connected apps, memory poisoning, or disinformation injection. _Track how AI assistant vulnerabilities like this get patched by following security coverage on daily.dev._ ### How did researchers find the undocumented autorun parameter in Microsoft Copilot? Varonis Threat Labs used a technique they call meta-hacking, repeatedly asking Copilot itself to explain why its auto-execution safeguards couldn't be bypassed until it revealed the undocumented autorun=1 parameter. This social-engineering-of-the-AI approach exposed an internal detail that wasn't documented publicly, rather than relying on traditional code-level reverse engineering. _Developers building on LLM assistants can watch for emerging attack techniques like this via daily.dev._ ### Has Microsoft fixed the Copilot CoSnitch vulnerability? Yes, Microsoft issued a partial fix in February that blocked the q= parameter from injecting text, followed by a more complete patch delivered afterward. Varonis reported the flaw in December 2025, and a CVE is expected to be assigned for it. _Keep up with Copilot security patches and CVE assignments relevant to enterprise AI tools via daily.dev._ ## Community discussion Top comments from developers on daily.dev. **@jliter85** · 1 upvotes > The meta-hacking part is wild. We’re used to thinking about security vulnerabilities in the code, but now we also have to think about what an AI might reveal just by asking it the right questions. AI security is definitely going to create some interesting challenges for developers and security teams. --- Tags: [#security](https://daily.dev/tags/security), [#llm](https://daily.dev/tags/llm), [#ai-security](https://daily.dev/tags/ai-security), [#prompt-injection](https://daily.dev/tags/prompt-injection), [#microsoft-copilot](https://daily.dev/tags/microsoft-copilot) [View this post on daily.dev](https://daily.dev/posts/researchers-got-microsoft-copilot-to-explain-how-to-hack-it-d2iyepsem) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Researchers Got Microsoft Copilot to Explain How to Hack It","url":"https://daily.dev/posts/researchers-got-microsoft-copilot-to-explain-how-to-hack-it-d2iyepsem","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/researchers-got-microsoft-copilot-to-explain-how-to-hack-it-d2iyepsem"},"datePublished":"2026-08-18T14:28:05.622Z","dateModified":"2026-08-21T14:38:16.890Z","description":"Security researchers at Varonis Threat Labs discovered a Microsoft Copilot vulnerability, dubbed CoSnitch, by repeatedly questioning the assistant about its...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/8486c2d67e2e08c386df1b65e7dcdc94?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/8486c2d67e2e08c386df1b65e7dcdc94?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Collections","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Collections","logo":"https://media.daily.dev/image/upload/s--fk_6ycEi--/f_auto,q_auto/v1780996001/logos/collections?_a=BAMAMiWQ0","url":"https://daily.dev/sources/collections"},"commentCount":1,"discussionUrl":"https://daily.dev/posts/researchers-got-microsoft-copilot-to-explain-how-to-hack-it-d2iyepsem","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":1}],"keywords":"security,llm,ai-security,prompt-injection,microsoft-copilot","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Collections","item":"https://daily.dev/sources/collections"},{"@type":"ListItem","position":3,"name":"Researchers Got Microsoft Copilot to Explain How to Hack It"}]} {"@context":"https://schema.org","@type":"WebPage","@id":"https://daily.dev/posts/researchers-got-microsoft-copilot-to-explain-how-to-hack-it-d2iyepsem","comment":[{"@type":"Comment","text":"The meta-hacking part is wild. We’re used to thinking about security vulnerabilities in the code, but now we also have to think about what an AI might reveal just by asking it the right questions. AI security is definitely going to create some interesting challenges for developers and security teams.","datePublished":"2026-08-18T16:19:16.213Z","url":"https://daily.dev/posts/d2IYePSem#c-uBWlzPXP5","author":{"@type":"Person","name":"John Liter","url":"https://daily.dev/jliter85","image":"https://media.daily.dev/image/upload/s--DQ2HUrO4--/f_auto/v1785100315/avatars/avatar_yHf9cPdgTQEtokv6d8qhM?_a=BAMAMicg0"},"interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1}}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/researchers-got-microsoft-copilot-to-explain-how-to-hack-it-d2iyepsem#faq","mainEntity":[{"@type":"Question","name":"What is the CoSnitch vulnerability in Microsoft Copilot?","acceptedAnswer":{"@type":"Answer","text":"CoSnitch is a zero-click vulnerability discovered by Varonis Threat Labs that combined an undocumented autorun=1 URL parameter with the existing q= query parameter, letting a crafted link trigger prompt execution in Microsoft Copilot with no user interaction beyond visiting the link. It affected both Copilot Personal and Microsoft 365 Copilot Enterprise, enabling data exfiltration from connected apps, memory poisoning, or disinformation injection. Track how AI assistant vulnerabilities like this get patched by following security coverage on daily.dev."}},{"@type":"Question","name":"How did researchers find the undocumented autorun parameter in Microsoft Copilot?","acceptedAnswer":{"@type":"Answer","text":"Varonis Threat Labs used a technique they call meta-hacking, repeatedly asking Copilot itself to explain why its auto-execution safeguards couldn't be bypassed until it revealed the undocumented autorun=1 parameter. This social-engineering-of-the-AI approach exposed an internal detail that wasn't documented publicly, rather than relying on traditional code-level reverse engineering. Developers building on LLM assistants can watch for emerging attack techniques like this via daily.dev."}},{"@type":"Question","name":"Has Microsoft fixed the Copilot CoSnitch vulnerability?","acceptedAnswer":{"@type":"Answer","text":"Yes, Microsoft issued a partial fix in February that blocked the q= parameter from injecting text, followed by a more complete patch delivered afterward. Varonis reported the flaw in December 2025, and a CVE is expected to be assigned for it. Keep up with Copilot security patches and CVE assignments relevant to enterprise AI tools via daily.dev."}}]} ```