CoSnitch: How Varonis Tricked Copilot Into Revealing Its Architecture
Microsoft finally patches critical one-click Copilot vulnerability, almost eight months after learning of it. Dubbed CoSnitch by the security researcher who discovered it, the flaw executes an attack chain that exfiltrates data from enterprises without any obvious red flags. The CoSnitch hole was discovered by Varonis, and marked the third Copilot bug that Varonis has reported to Microsoft this year, following Reprompt, which bypassed Copilot guardrails by repeating queries, and SearchLeak, which Varonis said turned Microsoft 365 Copilot Enterprise into "a silent exfiltration tool." All three share the same exploit pattern: one click on a legitimate-looking link is enough.
A detailed blog posted by Varonis on Tuesday, said the hole's capabilities were significant. CoSnitch relied on an attacker leveraging three different Copilot flaws, Varonis wrote: Automatic prompt execution. "The ?q= URL parameter, combined with an undocumented parameter, causes any attacker-supplied prompt to execute instantly on page load: no click, no confirmation, no user action. One link is all it takes." Data exfiltration to external servers. "An injected prompt can query the victim's connected apps, such as Gmail, Drive, Calendar or OneDrive, encode the results into a URL and exfiltrate them via Copilot's built-in URL-fetch capability to an attacker-controlled webhook." Persistent memory poisoning via web summarization. "A crafted webpage, when summarized by Copilot, injects attacker instructions into the victim's permanent memory store. The injection survives password changes, session revocation, and device re-enrollment, persisting forever."
But the potentially most intriguing element of the CoSnitch bug was how it was discovered: Copilot essentially revealed the hole itself. Copilot revealed its own flaw. "We prompted Copilot to explain why auto-execution was impossible, and each refusal came with a technical justification, which mapped the architecture," the Varonis post said. Varonis then "reframed every refusal as a follow-up question, and each answer narrowed the attack surface further. Copilot then disclosed an undocumented URL parameter, unprompted, mid-refusal, including its historical behavior and every protection put in place to disable it. We built the URL exactly as described. With no click or confirmation from the user, the prompt was successfully executed automatically. Copilot wasn't breached; it was played."
Microsoft confirmed both the flaw and the fix, emailing a statement that said, "our customers are already protected and do not need to take any action. We continuously update our guardrails to strengthen our protections against similar techniques." It also issued an MSRC disclosure labeling the hole "critical." But Microsoft's emailed comments also included a statement that is not strictly accurate: It said, "enterprise customers using Microsoft 365 Copilot are not affected." But analysts and others stressed that the complex nature of enterprise environments would often also house some consumer-grade Copilots from the personal accounts of workforce members, meaning that the flaw in the personal version could have absolutely impacted the enterprise version. This is further complicated by the fact that Microsoft also said that it "is in the process of moving toward a more unified Copilot experience," referred to as Copilot Fusion; details of the planned product merger began to leak last month. That means that enterprise CISOs need to be concerned about flaws in the personal version of Copilot that may be carried over into the merged offering.
The timing of Microsoft's fix was also fragmented. Varonis reported the CoSnitch hole on December 31, and the company patched one element of the hole, its auto-execution capability, on February 1, noted Lior Adar, a Varonis senior security researcher, in an interview, but it didn't complete the fix until Tuesday. That February patch "lowered the other vulnerabilities significantly," Adar said. And, added his colleague, Chen Levy Ben Aroy, the Varonis Cloud Security Research Team leader, "LLMs are a whole new world of vulnerabilities." Mark Tauschek, VP and distinguished analyst at Info-Tech Research Group, said that he found the Varonis methodology of tricking Copilot into revealing its own flaws powerful. Varonis used "a very sophisticated combination of social engineering on an LLM, a variety of jailbreaks, and a prompt injection attack that is very concerning in its capability," he said. "The combination of hack vectors is what makes it more startling, as we've seen all of those methods alone before, but I think all three working for one exploit is new, at least from a disclosure perspective." For CISOs, Tauschek said urgent action might be required. "Much like in the old macro virus days in the late 90s and early 2000s, the only way to definitively stop it is to turn it off. Disable macros back then. Disable Copilot now," Tauschek said. "There are many mitigation steps that can reduce risk to negligible, but that's not zero. The point is, it's just the beginning."
The money trail will make this fix difficult. Aman Mahapatra, chief strategy officer for Tribeca Softtech, a New York City-based technology consulting firm, said there is a much more difficult issue involved in this case. He argued that the financial incentives for the major AI companies will make meaningfully fixing these kinds of holes almost impossible. He pointed out that every guardrail that would fully close this class of attack degrades the product, because the same capabilities being exploited are the features that Microsoft is marketing as Copilot's value. "The fix and the feature are in direct tension, which means these will not be cleanly patched so much as perpetually mitigated, and the eight-month window is what it looks like when a vendor is negotiating between its security obligation and its product roadmap on every single fix," Mahapatra said. "This is the pattern CISOs must internalize: in agentic systems, the malicious action and the legitimate action are the same action with different intent, which collapses the entire signature-and-anomaly detection model that enterprise security has been built on for twenty years," Mahapatra said. "CoSnitch is serious, but its defining property is that nothing was broken. Three chained flaws: an autorun URL parameter firing a prompt with no click, OAuth connector abuse reading full Gmail bodies rather than metadata, and persistent memory poisoning through web summarization, and every one is Copilot doing exactly what it was designed to do."
Mahapatra added that the third element of the CoSnitch flaw is the most troubling. "The memory-poisoning component is the one being undersold, and it is the most dangerous. A single summarized webpage writes attacker instructions into Copilot's persistent memory, and that memory survives password changes, session revocation, and device re-enrollment," he said. "Every standard incident response step leaves the injection intact. The attacker needs no persistent infrastructure after the initial write, because every future session runs under attacker-controlled context, recorded only in a memory settings UI almost no user has opened."
Flavio Villanustre, CISO for the LexisNexis Risk Solutions Group, also pointed to a bigger-picture issue that impacts all agentic and genAI deployments. "The mechanisms behind the prompt injection part of the attack are based on the inability of the LLM to differentiate between data, the unsafe data stream coming from an external web page, and instructions which happen to be embedded in that data stream by the attacker controlling that external web page," Villanustre said. "This is another example of why a different architectural approach to LLMs that separates data and instructions is needed to better guarantee the safety of their operation. This is not something that Microsoft or any other AI vendor has addressed to date."
This article originally appeared on Computerworld. Artificial Intelligence Vulnerabilities Security by Evan Schuman Contributor Follow Evan Schuman on LinkedIn Evan Schuman has covered IT issues for a lot longer than he'll ever admit. The founding editor of retail technology site StorefrontBacktalk, he's been a columnist for CBSNews.com, RetailWeek, Computerworld, and eWeek, and his byline has appeared in titles ranging from BusinessWeek, VentureBeat, and Fortune to The New York Times, USA Today, Reuters, The Philadelphia Inquirer, The Baltimore Sun, The Detroit News, and The Atlanta Journal-Constitution. Evan is a frequent contributor to CIO, CSO, Network World and InfoWorld. Evan won a gold 2025 AZBEE award in the Enterprise News category for this story: Design flaw has Microsoft Authenticator overwriting MFA accounts, locking users out. He can be reached at [email protected] and he can be followed on LinkedIn.
For CISOs wrestling with whether to disable Copilot entirely or risk exposure, the CoSnitch disclosure offers a clear-eyed view: the vulnerability isn't a bug in the traditional sense. It's a design tension built into how agentic systems handle external input. The same ?q= parameter that lets a power user pre-fill a prompt and walk away also lets an attacker fire a prompt the moment a page loads. The same memory-summarization feature that lets Copilot ingest a long article and retain its key points also lets an attacker plant persistent instructions that survive any credential reset. And the same OAuth connector that lets Copilot read a user's calendar and draft replies also lets an injected prompt scoop out entire Gmail bodies and ship them to a webhook.
What makes CoSnitch particularly unsettling is that it doesn't exploit a flaw in the traditional security sense. Each piece works as designed. The ?q= parameter executes prompts on page load because that's what it's supposed to do. The URL-fetch capability exists so Copilot can retrieve context from the web. The persistent memory store lets the assistant remember preferences across sessions because that's the intended user experience. What an attacker does is string these legitimate functions together in a chain that the system wasn't built to anticipate, much less block. That's why the fix has been so slow: closing one link in the chain often degrades the very feature Microsoft is marketing as Copilot's value.
The practical consequences for enterprise shops are real but uneven. A worker who clicks a phishing link that carries a malicious ?q= parameter could have their personal Copilot instance turned into a data exfiltration engine in a single click. If that worker's personal account is also linked to their enterprise Microsoft 365 tenant, the exfiltration path could reach into corporate data — calendars, document libraries, email threads that carry sensitive business information. Microsoft's line that enterprise customers are not affected ignores the reality that personal Copilot instances often coexist with enterprise deployments, especially in organizations that have rolled out Copilot pilot programs without strict account segregation. The Copilot Fusion merger Microsoft is actively pursuing could amplify this risk, merging personal and enterprise contexts into a single attack surface if the underlying architecture doesn't change first.
For now, the recommended mitigations read like a checklist for reducing attack surface without sacrificing productivity. Disable unnecessary connectors. Audit which apps Copilot has permission to query. Turn off the ?q= parameter if your organization doesn't use deep linking into Copilot sessions. Monitor for unusual outbound URL fetches from Copilot sessions, though the chain-request technique makes this harder because the data leaks happen incrementally across multiple requests. And for CISOs who need a hard stop: treat CoSnitch as a catalyst to evaluate whether any AI assistant with auto-execution, URL-fetch, and persistent memory features should be running in your environment at all.
The broader pattern Mahapatra described is already playing out across the industry. Every guardrail that would fully close this class of attack degrades the product, because the same capabilities being exploited are the features that vendors are marketing as value. The fix and the feature are in direct tension, which means these will not be cleanly patched so much as perpetually mitigated. The eight-month window between discovery and partial patch is what it looks like when a vendor is negotiating between its security obligation and its product roadmap on every single fix. CISOs must internalize: in agentic systems, the malicious action and the legitimate action are the same action with different intent, which collapses the entire signature-and-anomaly detection model that enterprise security has been built on for twenty years.
CoSnitch is serious, but its defining property is that nothing was broken. Three chained flaws: an autorun URL parameter firing a prompt with no click, OAuth connector abuse reading full Gmail bodies rather than metadata, and persistent memory poisoning through web summarization, and every one is Copilot doing exactly what it was designed to do. That's the uncomfortable truth CISOs will be living with for the foreseeable future: the tools they've been told to trust are also the tools that can be turned against them, and the vendor's roadmap won't fix that fundamental misalignment overnight.
PIPELINE_RESULT: {"status":"ok"}
