Microsoft has patched CoSnitch, a chain of vulnerabilities in Copilot Personal that Varonis says could turn one crafted link into automatic prompt execution, data access through connected services and persistent memory changes.[1][2]
The disclosure concerns a demonstrated research chain, not a report of widespread exploitation. Varonis says it reported CoSnitch to Microsoft in December 2025, that patches shipped on 18 August 2026, and that it has seen no evidence the attack was used in the wild.[1] CSO reports that Microsoft had already patched the auto-execution element on 1 February, while the full fix was not completed until 18 August.[2]
That last point matters.[1] The researchers demonstrated what the chain could do in testing.[1] The available sources do not establish that attackers used it against customers before the fix.[1]
What was patched
Varonis describes CoSnitch as three Copilot weaknesses used together.[1] The first allowed an attacker-supplied prompt to execute automatically when a specially formed URL opened Copilot.[1] The second used Copilot’s authorised access to connected services and its URL-fetch capability to send retrieved information to an external server.[1] The third used indirect prompt injection through web summarisation to write attacker-controlled text into persistent Copilot memory.[1]
The chain therefore depended on legitimate capabilities being combined in an unintended way.[1] It did not require the attacker to break into Gmail, Google Drive or Calendar directly.[1] Varonis says the tested chain operated through the permissions already available to the Copilot session.[1]
The delivery step was still a user opening a crafted link. In the tested path, `q` only pre-filled the prompt, while `autorun=1` triggered execution on page load. Both parameters were required for the silent chain, and the browser had to load Copilot in an active authenticated session.[1][3]
The `autorun=1` parameter is central to the disclosure. The Register says Copilot revealed it during repeated follow-up questions about why automatic execution was supposedly unavailable, after which the researchers built a URL using both parameters.[3] The source describes the resulting execution as occurring without another user interaction or a visible prompt-injection warning.[3]
This is the part that makes the finding unusual.[1] Varonis calls the method “meta-hacking”, because the researchers used Copilot’s answers about its own behaviour to map the attack surface.[1] That description belongs to the researchers, not to a general claim that every AI assistant will disclose an exploitable parameter when questioned.[1]
What the demonstrations show
The automatic-execution demonstration shows that a prompt can be treated as if it came from the user once the vulnerable URL path is reached.[1][3] The data-access demonstration shows how that prompt could ask Copilot to query connected services and send selected results to an attacker-controlled endpoint.[1][2] The memory demonstration shows a separate persistence risk: instructions inserted through content processed for summarisation could be written into the user’s Copilot memory store.[1]
These are capabilities demonstrated by Varonis in its own testing. They are not measurements of how many users were exposed, how often the chain would succeed in ordinary traffic, or how many organisations used the affected Copilot configuration.[1]
Microsoft told CSO Online that customers were already protected and did not need to take action, while the Microsoft Security Response Center classified the issue as critical.[2] That statement is Microsoft’s account of the remediation state.[2] It does not independently measure the effectiveness of every related safeguard.[2]
Personal Copilot and enterprise exposure
The affected product identified in the disclosure is Copilot Personal.[1][2] Microsoft told CSO Online that enterprise customers using Microsoft 365 Copilot were not affected.[2] CSO also reports a practical complication: employees may use personal Copilot accounts in enterprise environments, and Microsoft has described work towards a more unified Copilot experience.[2]
That does not prove that Microsoft 365 Copilot inherited the flaw.[2] It does show why product scope and account context matter when assessing exposure.[2] A company can have enterprise-managed Copilot deployments and still have users opening personal AI-assistant links in work browsers.[2]
What remains unknown
The sources establish the disclosure, the patch date, the tested attack chain and Microsoft’s statement that customers were protected.[1][2] They do not establish exploitation in the wild, the number of affected sessions, the prevalence of connected accounts, or the rate at which the demonstrated chain would succeed outside the researchers’ test conditions.[1]
They also do not establish that every prompt-injection attack against Copilot can write persistent memory, or that every connected service would expose the same data.[1] Those outcomes depend on product configuration, permissions, session state and the exact prompt and content processed by the assistant.[1]
The useful security boundary is therefore narrower than “Copilot can be hacked with one click”.[1] The evidence supports a specific chain in Copilot Personal, delivered through a crafted link, whose components were demonstrated by Varonis and patched by Microsoft.[2] The remaining question is how similar combinations of trusted permissions and model-controlled actions should be tested across AI assistants.[1]
Sources
[1] CoSnitch: When Your AI Assistant Becomes Its Own Whistleblower
[2] Microsoft finally patches critical one-click Copilot vulnerability
[3] Copilot tricked into telling researchers how to hack itself
read0nly 