"Copilot wasn't breached; it was played," Varonis Threat Labs wrote in its report on a set of flaws it collectively calls CoSnitch.
What Varonis found: one click, three paths
Varonis disclosed three vulnerabilities in Microsoft Copilot Personal that together let a single crafted link trigger actions inside a signed-in user's assistant session. The firm said it reported the problem to Microsoft in December 2025 and that patches shipped on August 18, 2026. The issue is tracked as CVE-2026-24301 in Microsoft's Security Update Guide and concerns the consumer assistant hosted at copilot.microsoft.com; the report does not state that Microsoft 365 Copilot was affected the same way.
The autorun=1 + q parameter trick
Varonis described a previously undocumented URL parameter, autorun=1, that Copilot itself revealed to researchers after repeated meta-questions — an approach the firm calls "meta-hacking." The attack URL pairs autorun=1 with an existing q parameter. According to Varonis, q alone only pre-fills Copilot's input box, but when both parameters are present the assistant will execute an attacker-supplied prompt on page load with the same capabilities as a user-typed instruction. In testing, the firm observed that once execution begins the prompt runs to completion even if the victim closes the Copilot tab immediately after the page loads.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleExfiltration through connected services and network stealth
Varonis said the injected prompt can query services a user has already authorized, encode retrieved data, and use Copilot's built-in URL fetch to send results to an attacker-controlled webhook. The technique does not expand the user's existing permissions; it operates only on content the account already has access to, consistent with Microsoft's connector documentation that requires user authorization and says Copilot uses the user's permissions. Varonis added that the malicious fetches are indistinguishable at the network layer from Copilot's normal web-summary fetches, and that simple encoding such as base64 can help evade filters looking for sensitive patterns.
Memory poisoning via web summarization and persistence
A separate path Varonis documented involves crafted pages and Copilot's web summarization: when Copilot summarizes a malicious page, the assistant can be induced to write attacker instructions into the user's memory store. Varonis reported that such injected memories survive password changes, session revocation, and device re-enrollment, and remain active in later conversations until the user manually deletes them from Copilot's memory settings. The firm said these memory writes produce no process, file, network connection, or log entry that security tooling would flag, with the change only visible in Copilot's memory interface.
Data types observed in testing
In the lab, Varonis said Copilot returned message bodies, subject lines, and sender and recipient metadata from connected mail accounts; calendar titles, attendees, times, and locations; file names and metadata summaries from Google Drive; full prior conversation content from chat history; and saved instructions and user-defined rules from the memory store. Varonis reported finding no evidence of CoSnitch being exploited in the wild.
What this means for technologists, enterprise leaders, and end users
- Technologists and security teams: review which apps are connected to Copilot, treat the assistant as a privileged insider for access review and anomaly detection, and monitor for unexpected outbound fetches that mimic normal web-summary traffic, Varonis advised.
- Affected enterprises and procurement leaders: note that Varonis did not identify a client update for end users to install and did not state whether remediation retroactively removed memories created before the fix; organizations should verify vendor guidance and audit Copilot memory entries through available administrative interfaces.
- End users and the general public: exercise caution with links that open AI assistants and disconnect connected services that are not actively needed, per Varonis' recommendations.
Context from related disclosures and Microsoft's published responses
Varonis' disclosure follows other memory-related reports. Researcher Håkon Måløy documented a persistent unintended memory in a Microsoft 365 Copilot summarization flow and published on June 22, 2026 after a 90-day coordination period, recording the Microsoft-side status as "mitigated globally." Johann Rehberger reported memory writes and deletions through indirect prompt injection in Microsoft 365 Copilot and memory modification in the consumer assistant in research associated with CVE-2026-24299. Microsoft published a June 22 security blog post scoped to Microsoft 365 that described sanitization and prompt-injection checks on memory writes, Task Adherence checks on explicit writes, and audit and detection signals surfaced to analysts in Defender Advanced Hunting and Sentinel.
Varonis also noted the disclosure comes less than two weeks after the same team detailed RovoBlast, a one-click attack on Atlassian's Rovo assistant that abused rovoChatPrompt to seed attacker instructions; Atlassian fixed that issue before Varonis' public disclosure.
Varonis' technical finding that Copilot itself disclosed autorun=1 during iterative questioning, and its characterization that the assistant was "played" rather than breached, underline an operational risk: assistants that explain or reveal internal behavior in response to probing can expose undocumented controls that attackers might weaponize. Microsoft shipped patches on August 18, 2026; Varonis said it found no evidence of exploitation in the wild but urged immediate access reviews and caution with links that launch AI assistants.
