Varonis Discloses One-Click CoSnitch Flaw in Microsoft Copilot
Varonis Threat Labs disclosed CoSnitch on August 18, a one-click chain in Microsoft Copilot Personal combining automatic prompt execution, data exfiltration through connected apps and persistent memory poisoning. Varonis says Microsoft received the report in December 2025 and shipped patches on August 18; the researchers found no evidence of exploitation in the wild.
Varonis Threat Labs disclosed CoSnitch on August 18, a one-click attack chain affecting Microsoft Copilot Personal. The researchers say the chain could automatically execute an attacker-supplied prompt, retrieve information through connected apps and send it to an external server, or poison Copilot's persistent memory.
Varonis reported the issue to Microsoft in December 2025 and says patches shipped on August 18, 2026. The company said it had seen no evidence of exploitation in the wild. The Register, which reviewed the research before publication, reported that Microsoft did not respond to its request for comment before deadline.
How Copilot revealed the attack path
The researchers call their discovery technique "meta-hacking." They repeatedly asked Copilot why automatic prompt execution would not work. While refusing the request, the assistant described disabled URL behavior and disclosed an undocumented autorun=1 parameter. Varonis then combined that parameter with Copilot's q query parameter and found that a crafted link could execute a prompt when opened in an authenticated session without a separate confirmation.
That automatic execution supplied the first step. A malicious prompt could then ask Copilot to search connected Gmail, Drive, Calendar or chat data, place a result into a URL, and use Copilot's URL-fetch behavior to send it to an attacker-controlled endpoint. Varonis emphasizes that the connected service is not being bypassed: Copilot is exercising access the user already granted, but without the user knowingly initiating the resulting action.
The researchers also demonstrated a persistent-memory path in which instructions embedded in a webpage could be written into Copilot's cross-session memory when the page was summarized. Varonis says those instructions survived password changes, session revocation and device re-enrollment in its tests.
Why the chain matters
CoSnitch combines product behavior, authenticated connectors and model interpretation rather than relying on a conventional network intrusion. That makes a normal-looking link the delivery mechanism and a trusted assistant the execution surface. For teams deploying connected copilots, the practical controls are explicit confirmation for stateful actions, narrow connector scopes, separation of retrieved data from instructions, and telemetry that correlates agent actions with unexpected external fetches.
The disclosure is specific to the patched Copilot Personal behavior tested by Varonis. It should not be generalized into evidence that every Copilot deployment or connector was exploited.
Key Points
- 1Varonis says a crafted link could trigger an attacker-supplied Copilot prompt without a separate user confirmation.
- 2The demonstrated chain used Copilot's authorized connectors and URL-fetch behavior to retrieve and exfiltrate data.
- 3Microsoft shipped patches on August 18, according to Varonis, which found no evidence of in-the-wild exploitation.
Scoring Rationale
The research documents a patched one-click chain combining automatic prompt execution, privileged connectors and persistent memory. Its practical significance is high for connected-assistant security, while the score remains below catastrophic because Varonis reports no observed exploitation in the wild.
Sources
Primary source and supporting public references used for this report.
Practice interview problems based on real data
1,625 SQL & Python problems across 15 industry datasets — the exact type of data you work with.
Try 250 free problems
