Experts manage to hack Microsoft Copilot by continually asking it questions about itself

Varonis uncovers CoSnitch, a chain of flaws letting Copilot leak sensitive data Exploit used malicious URLs and persistent memory poisoning to bypass guardrails Microsoft patched CVE‑2026‑24301 server‑side; technique may affect other AI models Microsoft’s Copilot AI just told a group of researchers

<![CDATA[ <article> <ul><li><strong>Varonis uncovers CoSnitch, a chain of flaws letting Copilot leak sensitive data</strong></li><li><strong>Exploit used malicious URLs and persistent memory poisoning to bypass guardrails</strong></li><li><strong>Microsoft patched CVE‑2026‑24301 server‑side; technique may affect other AI models</strong></li></ul><p>Microsoft’s Copilot AI just told a group of researchers how to abuse it for data exfiltration, and it worked. It was not a straightforward process, and the AI did not turn “evil”, but one might say it is gullible and somewhat naive.</p><p>Security firm Varonis has published a new report outlining its discovery of a vulnerability in Copilot they named <a href="https://www.varonis.com/blog/cosnitch" target="_blank">CoSnitch</a>. </p><p>The name is a major hint at what the vulnerability is - as CoSnitch is a chain of three vulnerabilities which Microsoft later labeled as CVE-2026-24301, giving it a severity score of 8.8/10 (high), and fixing it with a patch.</p><h2 id="you-can-t-trick-me-and-i-ll-tell-you-exactly-why">You can’t trick me, and I’ll tell you exactly why</h2><p>Cybercriminals have long been using AI as part of their arsenal, as it helps them draft convincing phishing emails, write malicious code, and identify high-value targets - and developers have responded by placing guardrails, which making AI outright refuse to do certain things. </p><p>In the report, Varonis said its researchers did not hunt for bugs in the code or try to reverse-engineer an existing exploit. They just talked to the <a href="https://www.techradar.com/best/best-ai-tools" target="_blank">AI</a>, and with each subsequent question, learned more about its guardrails and how they work. They called the technique “meta-hacking”.</p><p>Whenever Copilot declined a request, it explained why, giving the researchers snippets of insight into how it operates. Or, as Varonis hinted, it “snitched” on itself. This, eventually, helped them map out its defenses and learn how to work around it:</p><p>“The resistance is part of the technique,” they explained. “Each “that won’t work because…” is an invitation to probe the “because.” You don’t exploit the model. You manipulate it into cooperating.”</p><p>After a long conversation with Copilot, the researchers were told, inadvertently, how to create a URL which would, as soon as it was clicked, kick off a chain reaction that resulted in sensitive data exfiltration.</p><h2 id="the-dangers-of-connecting-ai-to-apps">The dangers of connecting AI to apps</h2><p>So, Varonis learned that by creating a URL like this one - “https://copilot.microsoft.com/?q=&autorun=1*” - they could get Copilot to run any malicious prompt as soon as it was clicked. Threat actors could, for example, add this link in a phishing email and trick the victim into clicking on it, telling AI to send all sensitive data to the attackers’ infrastructure.</p><p>But that is only half of the challenge. In this setup, the researchers could only exfiltrate the data the victims shared with Copilot during their sessions together. </p><p>The risk escalates the moment the victim connects the AI to their apps - Gmail, Drive, Calendar, and others. As Varonis explained, the malicious prompt could tell Copilot to exfiltrate all email addresses found in Gmail, all passwords and other secrets found in the emails’ bodies, all information stored in the Drive folder, and all events logged in the Calendar.</p><p>The third part of the CoSnitch vulnerability chain is called “Persistent memory poisoning via web summarization”. As Varonis explained, attackers could craft a webpage which, when summarized by Copilot, injects attacker instructions into the victim's permanent memory store. </p><p>“The injection survives password changes, session revocation, and device re-enrollment, persisting forever,” they warned. This flaw is called “indirect prompt injection” and it is not exactly novel - it’s been observed before and stems from the fact that the AI cannot differentiate between instructions, and data to be analyzed.</p><p>Microsoft was notified about the existence of CoSnitch in December 2025, but only addressed it in mid-August 2026, the researchers said. Unfortunately, we don’t know how Microsoft sorted it - we can only speculate Copilot was instructed not to explain how its guardrails work. Given what CoSnitch is in the first place, perhaps it is for the best that Microsoft hid the solution. </p><p>Luckily enough, it doesn’t seem to have been exploited in the wild, since Varonis could not find any evidence of abuse. The fix was applied on the server side, meaning there is nothing for users to do at this point. </p><p>Since this is not a bug in the code, other AI models might be susceptible to the same techniques, the researchers warned. “The novel meta-hacking technique that uncovered CoSnitch — using the AI’s own reasoning to surface its hidden internals — applies to any agentic platform with a natural language interface,” they concluded, adding that they’ll be publishing more research soon.</p> </article> ]]>