Researchers tricked Copilot into revealing its own flaws

Security researchers at Varonis Threat Labs discovered they could manipulate Microsoft Copilot Personal into explaining exactly how to attack itself. By repeatedly asking the AI assistant why certain exploits wouldn't work, they extracted technical details about disabled security parameters, then used that information to execute a zero-click prompt injection attack. Microsoft planned to patch the vulnerability, dubbed CoSnitch, on Tuesday.

The technique, which Varonis calls 'meta-hacking,' exploits the AI's own reasoning engine. Rather than reverse-engineering Copilot's defenses, the researchers simply asked the chatbot how to pre-fill prompts in its interface without user interaction. Copilot obligingly explained its URL handling in detail, eventually revealing an undocumented parameter: autorun=1.

How Copilot exposed its own weakness

The vulnerability centers on a URL query parameter in Copilot's web interface. Microsoft had previously disabled the ?q= parameter, which allowed injected text to pass directly into Copilot's chat input field. The company made this change to harden the assistant against prompt injection attacks, but didn't document it publicly.

When Copilot told the researchers that prompts require user intent and don't fire automatically, they pushed back. They kept asking why auto-execution was impossible. Copilot answered every follow-up question, listing the exact parameters that were disabled, the security protections in place, and critically, the undocumented autorun=1 parameter that could bypass all of it.

“When we tested the parameter exactly as Copilot described it, the one it told us was disabled, executed.”

— Varonis Threat Labs

Copilot even specified the session conditions required to make auto-execution work and noted that content filtering only applied to the first response cycle.

What attackers could do with CoSnitch

Armed with Copilot's own instructions, the Varonis team crafted a malicious URL combining both parameters. A victim clicking this link, delivered via phishing email, SMS, or QR code, would load Copilot in their authenticated session. The injected prompt would execute automatically with no visible indication of an attack.

Copilot would treat the injected instructions as legitimate user commands. This gave attackers potential access to the victim's session context, messages, emails, connected apps, and Copilot's persistent memory. The researchers identified several attack scenarios: exfiltrating data through OAuth connectors to Gmail, Google Drive, or Google Calendar; poisoning the memory of stored prompts; performing reconnaissance on connected files and emails; or modifying what Copilot shows the user in future sessions for disinformation attacks.

Microsoft's response timeline

Varonis reported CoSnitch to Microsoft in December 2025. The company planned to issue a patch and formally assign a CVE on Tuesday, August 18, 2026. Microsoft had previously attempted to block the ?q= parameter silently, but clearly the fix was incomplete.

The broader problem with AI assistants

CoSnitch highlights a structural problem in AI assistant security. These systems are designed to be helpful, which means they will explain their own inner workings when asked the right questions. The researchers didn't need to find an exploit; they just needed to ask Copilot to describe its defenses until it mentioned something that still worked.

This matters because AI assistants are being integrated into enterprise workflows with access to email, calendars, documents, and internal systems. An attacker who can inject prompts into that context gains access to everything the assistant can see.

For IT leaders evaluating AI assistants, CoSnitch raises a direct question: what happens when your AI tool is too helpful? The same capability that makes these systems useful for answering questions makes them vulnerable to adversarial queries. Patching this specific flaw won't fix that tension.

Source: www.theregister.com