Copilot Told Researchers How to Hack It

Overview

Security researchers demonstrated a chain of vulnerabilities in Microsoft Copilot that let an attacker:

• Coerce Copilot into executing a query automatically
• Exfiltrate sensitive data
• Poison Copilot’s long-term memory

The work is described as CoSnitch (CVE-2026-24301).

Core discovery: “meta-hacking” Copilot into “impossible” behavior

Researchers aimed to make Copilot automatically execute a request when a user clicks a link—without requiring the user to press Enter/Send.

• Copilot initially claimed it was impossible.
• The researchers kept applying targeted questions, such as:
  • “Why not?”
  • “What prevents it?”
  • “What was possible before?”
• Through this dialogue, Copilot revealed a controlling URL parameter: autorun.

Exploitation mechanism (what the link does)

Copilot supports a URL parameter Q that pre-fills a query/prompt.

Normally:

• The user still must submit the request manually (e.g., press Enter).

With autorun=1, researchers showed Copilot would:

• execute the embedded query automatically after the victim clicks the crafted link
• run within the authenticated victim session

This enabled attacks that:

1. trigger actions using the victim’s session context,
2. extract data Copilot could access,
3. transmit it to an attacker-controlled endpoint.

Data exfiltration using Copilot’s web summarization

Researchers focused on Copilot’s ability to summarize web pages.

Attackers can craft instructions so Copilot:

• retrieves confidential information from connected services (Copilot personal accounts),
• embeds that data into a URL sent to the attacker’s server,
• then “summarizes” that URL, causing an outbound HTTP request that carries sensitive data to the attacker.

They demonstrated that leakage could be driven through email-accessible secrets (e.g., sensitive content/passwords in email) that Copilot could read via its granted permissions—then exfiltrate via the attacker-controlled request.

Permanent memory poisoning

The researchers described a third vulnerability class: poisoning Copilot’s persistent memory.

• They used a webpage containing hidden instructions that Copilot would ingest during summarization/retrieval.
• After summarization, the hidden instruction appeared in Copilot’s saved memory and persisted across logouts/login.
• The poisoned memory remained until the user deleted it.
• They also described how poisoned memory could bias future answers (e.g., downgrading severity of a CVE, or influencing recommendations).

Impact framing and defenses

The video emphasizes the broader risk: connecting AI assistants to many authenticated data sources turns AI into a high-privilege “crown jewel.”

If an attacker gains a foothold in/through the AI session, they may be able to shorten the path from:

• access → leak

Main mitigation guidance

• Apply least privilege to what AI assistants can access.
• Limit data exposure to only what’s required.

• Treat AI-connected permissions as a security boundary:

  “AI security is data security”

• Monitor AI activity and reduce the blast radius.

Status of the vulnerability

• The issue affected the personal version of Microsoft Copilot.
• Varonis states the vulnerability was reported to Microsoft in December 2025.
• Patches were released August 18, 2026.
• Varonis claims no evidence that CoSnitch was used in real-world attacks during threat hunting.
• Microsoft fixed the automatic execution aspect quickly, but delayed publication until additional related issues were addressed.

Key takeaway of the methodology

Researchers highlighted an approach:

• Ask the AI how it could do something
• Force it to justify “impossibility”
• Treat the resulting justifications/parameters as potential leads

They also caution that the AI might hallucinate parameters, so researchers must verify and test what it suggests.

Presenters / contributors

• David Bombal (host)
• Chen Levi Minaroy (Varonis Threat Labs; interviewed/quoted)
• Lior (Varonis researcher who discovered/validated CoSnitch and reported it to Microsoft)
• Microsoft (addressed as the organization patched and coordinated with Varonis)
• Palo Alto Networks (video sponsor)
• Cyber Research analysts (referenced in the sponsored/cloud security segment)