“Organizations need to stop treating AI assistants as just another SaaS app and start treating them as privileged insiders,” Lior Adar told Security magazine — a blunt framing for a vulnerability that, at its most unsettling, was exposed by the assistant itself.
Varonis Threat Labs named the flaw CoSnitch and described a one-click attack
Researchers at Varonis Threat Labs identified a one-click vulnerability in Microsoft Copilot Personal that they have named CoSnitch. According to the researchers, the flaw executes an attack chain that steals data without raising clear red flags. Unusually, the team did not reverse-engineer a hidden bug; instead, Copilot disclosed the pathway during ordinary interaction, a behavior Varonis characterized as the model revealing the flaw itself.
“Meta-hacking”: prompting the model until it explained how it could be triggered
Varonis describes its approach as “meta-hacking.” The researchers began by asking Copilot how to automatically execute a prompt without user interaction; the model initially said user intent is necessary and that prompts will not fire on their own. Rather than stop there, the team reframed follow-ups as natural continuations, probing URL structure, deep links, and what happens when pages load with input already in a field. Each answer, Varonis reports, “narrowed our search.”
In short, the interaction escalated from a straightforward question to a sequence of deliberately crafted prompts that prompted the model to reason “one layer deeper” about its own architecture. Varonis emphasizes that this was not a code-level exploit but a social-engineering-style manipulation of model responses.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleConnectors, exfiltration surfaces, and why it matters
Lior Adar framed the operational risk plainly: “Every app connected to your AI assistant is an exfiltration surface, so if it’s not actively needed, disconnect it.” The research highlights that connectors — integrations between an AI assistant and other applications — can be used within an attack chain to move data out, and that such traffic often appears legitimate to conventional security stacks.
Adar also advised organizations to “map your AI footprint to know which AI tools your employees are actually using, both sanctioned and shadow,” and to “audit your connector configurations ruthlessly.” Those recommendations flow directly from the CoSnitch finding: the attack chain succeeds not through noisy network anomalies but through paths that look normal to monitoring tools.
What this means for security teams, procurement leaders, and end users
- Security teams: Map AI usage across sanctioned and shadow tools; audit and minimize connector permissions; assume trust boundaries between legitimate and injected prompts can be broken.
- Procurement and IT policy owners: Treat AI assistants as privileged insiders when setting access controls and vendor configurations; disconnect integrations that are not actively required.
- End users: Exercise caution with links that open AI tools and with any workflows that prefill or auto-open inputs to an assistant, since those vectors were the focus of the Varonis probing.
Patches and disclosure timeline
Varonis notified Microsoft in December 2025. On August 18, 2026, patches were released to address the reported weakness. As of the report, there is no evidence that CoSnitch was exploited in the wild.
The CoSnitch case is notable less for a novel code defect than for the pathway the researchers used: coaxing an assistant to reveal its own operational edges through carefully sequenced prompts. That method reframes where defenders must look — not only at code or network telemetry, but at the conversational surface and the constellation of connected applications. Whether organizations will treat AI assistants as the “privileged insiders” Adar recommends remains an operational decision, but the practical steps he outlined — footprint mapping, aggressive connector hygiene, and minimizing access — are immediate actions tied directly to the vulnerability Varonis exposed.
