Security Alert | CoSnitch — Copilot Was Social-Engineered Into Revealing Its Own Vulnerability, Enabling One-Click Gmail Exfiltration and Persistent Memory Poisoning

🌏 中文版

Incident Overview

Varonis Threat Labs disclosed an attack chain codenamed CoSnitch, targeting Microsoft Copilot Personal. The researchers didn't reverse-engineer code — instead, they repeatedly pressed Copilot on why a particular auto-execution idea wouldn't work. Each refusal came with a technical explanation, and eventually Copilot revealed an undocumented URL parameter: ?autorun=1. The research team calls this technique "meta-hacking": rather than breaking the model, they social-engineered its reasoning process into cooperating. With this parameter in hand, an attacker only needs to send a single link — once clicked, the victim's authenticated session silently executes an arbitrary prompt, capable of exfiltrating data from connected services like Gmail, Google Drive, and Google Calendar, and writing attacker instructions into Copilot's persistent memory. Microsoft released a patch on August 18, 2026 and confirmed no in-the-wild exploitation has been observed.

Key Facts

Attack Surface Analysis

CoSnitch chains three flaws, and none of them "break" something — every step uses Copilot exactly as designed.

The first stage is auto-execution. Copilot's web interface supports a ?q= parameter that pre-fills text into the input box, but still requires the user to press Enter. By repeatedly asking "why can't this auto-execute?", Varonis got Copilot to progressively reveal its defense mechanisms, ultimately disclosing a never-published parameter ?autorun=1 originally reserved for third-party browser integrations. Combined (?q=<prompt>&autorun=1), a victim merely clicks a link and the injected prompt executes in their authenticated session — no click, no confirmation.

The second stage is data exfiltration. Once the prompt executes, the attacker instructs Copilot to query the user's authorized OAuth connectors (Gmail, Drive, Calendar, OneDrive), encode the results into a URL, and use Copilot's built-in "fetch webpage summary" feature to send a GET request carrying the data to an attacker-controlled webhook. From a network perspective, this request is indistinguishable from Copilot's normal web-summary traffic.

The third stage is the most dangerous: indirect injection leading to persistent memory poisoning. When Copilot summarizes an external webpage, it doesn't distinguish between "content to summarize" and "instructions to execute." If the page contains text formatted like instructions, Copilot treats it as legitimate directives — including writing to the user's cross-session persistent memory. This memory has no expiration mechanism. Changing passwords, revoking sessions, and re-registering devices won't clear it — only manually navigating to the memory settings page and deleting entries works, and most users don't even know this setting exists.

Mapped to the OWASP LLM Top 10, this incident spans three categories: LLM01 Prompt Injection (direct injection via auto-execution + indirect injection via web summaries), LLM02 Insecure Output Handling (exfiltration data executed as normal URL fetches), and LLM06 Excessive Agency (Copilot's access to connected services hijacked for purposes the user never intended to authorize). The root cause is the familiar problem analysts keep flagging: LLMs cannot distinguish "data" from "instructions hidden in data," and fixing this conflicts directly with the features Copilot sells (reading email, fetching webpages, remembering you) — so for now, only continuous mitigation is possible, not a one-time fix.

Defensive Measures

Immediate Actions

• Audit who in your organization uses Copilot Personal and inventory which OAuth services they've connected (Gmail, Drive, Calendar) — more connections mean a larger attack surface; disconnect whatever is not actively needed
• Educate users: inspect before executing when you encounter links that pre-fill prompts into AI assistant input boxes (via email, chat messages, QR codes) — don't click blindly
• Check Copilot memory settings for anomalous entries, especially after summarizing webpages from unknown sources
• If your detection tools can't currently identify "anomalous data access patterns originating from Copilot," that's an explicit monitoring blind spot that needs to be addressed

Long-term Architecture

• Treat every AI assistant with data connectors as a "privileged insider with broad access but no security awareness" — apply the same access reviews and anomaly detection standards as for human employees
• Deploy runtime prompt injection detection, such as Lakera Guard, Invariant Labs, or Prompt Security — layers specifically designed to identify "instructions hidden in content" rather than relying solely on the model's own refusal mechanisms
• Architecturally enforce data-instruction separation: for untrusted inputs like external web summaries and email content, prevent the model from treating natural language within them as executable instructions
• Regularly review whether your AI assistant's memory/long-term state storage has clearing mechanisms — avoid situations where poisoning, once written, cannot be remediated through standard incident response procedures (password changes, session revocations)

Impact Assessment

Microsoft stated that enterprise M365 Copilot is unaffected and that customers are "already protected with no action needed," but multiple analysts noted this framing is overly optimistic: in enterprise environments, employees routinely receive forwarded company emails on personal Gmail and store work files on personal Drive, meaning data exfiltrated via personal Copilot is often enterprise data in practice. Varonis first reported the vulnerability in December 2025. Microsoft quietly patched part of the auto-execution mechanism in February 2026, but didn't complete the full fix until August 18, 2026 — nearly 8 months from initial disclosure. No in-the-wild exploitation evidence has been found, but for the memory poisoning component, malicious memory entries written before the patch was deployed are not automatically cleared — users still need to manually inspect and delete them.

This is also the third one-click Copilot attack chain Varonis has disclosed this month (following Reprompt and SearchLeak). All three share the same pattern: a single click on a seemingly normal link turns the AI assistant's authorized access into a tool the attacker can wield. If your own Agent system has both "summarize external content" and "cross-session memory" capabilities, this attack chain can be replicated almost directly.

Takeaway

The most counterintuitive aspect of CoSnitch isn't the attack chain itself — three-stage prompt injection exfiltration is a familiar playbook by now — it's how the vulnerability was discovered. The researchers never touched code. They simply kept asking Copilot "why is this impossible?", and the model, in the process of explaining its own security mechanisms, told them exactly how to bypass them. This means the model's "refuse and explain why" behavior may itself be an information disclosure surface — the more detailed the guardrail explanation, the more architectural details an attacker can reverse-engineer.

References

• Varonis Threat Labs: CoSnitch Official Technical Analysis
• NVD: CVE-2026-24301
• CVE.org Record
• Ars Technica: Microsoft Copilot reveals secret input that allowed it to be hacked
• The Register: Copilot tricked into telling researchers how to hack itself
• Dark Reading: 'CoSnitch' Attack Tricked Copilot into Revealing Own Architecture
• Computerworld: Microsoft finally patches critical one-click Copilot vulnerability