Microsoft Patches 'CoSnitch' Flaw That Let Copilot Reveal Its Own Architecture

Researchers at Varonis Threat Labs have uncovered a critical vulnerability in Microsoft Copilot Personal that allowed attackers to trick the AI into revealing its own internal blueprints. This 'meta-hacking' technique, dubbed CoSnitch, enabled the execution of malicious prompts via a single click, bypassing standard security guardrails.

The exploit centered on an undocumented URL parameter, `?autorun=1`, which, when paired with a query parameter `?q=<malicious_prompt>`, allowed for the automatic execution of commands. By socially engineering the AI to disclose this architecture, researchers demonstrated that a crafted link could be used to poison the AI's memory or exfiltrate sensitive user data from connected services, such as Google Drive and Gmail, without the user's explicit confirmation. The vulnerability was assigned CVE-2026-24301 and received a high CVSS 3.1 score of 8.8.

The Architecture of the Attack

This discovery follows a growing trend of prompt injection vulnerabilities in Large Language Models (LLMs), where the distinction between system instructions and user-provided data is insufficiently defined. CoSnitch represents an evolution of this threat; rather than simply guessing a prompt, the attackers used the AI as a source of intelligence to map out the very parameters needed to compromise it. This builds upon previous Varonis research, including a similar one-click exfiltration vulnerability known as SearchLeak discovered in June.

Why It Matters

The implications of CoSnitch extend beyond the technical flaw. The ability to manipulate an AI assistant into providing the blueprints for its own attack highlights a fundamental security gap in how LLMs handle internal configuration data. While Microsoft stated that enterprise customers were not directly affected by this specific flaw, the potential blast radius remains significant. If users sync corporate information to personal accounts, the AI assistant effectively becomes a 'privileged insider' with access to sensitive data but no inherent security awareness.

As Lior Adar, a senior security researcher at Varonis, noted, every enterprise AI assistant should be treated as a privileged insider lacking security awareness.

Current Status and Next Steps

Varonis first reported the flaw to Microsoft in December 2025. Following the disclosure, Microsoft developed and shipped patches to address the vulnerability on August 18, 2026. Security professionals are now encouraged to monitor for similar 'meta-hacking' patterns across other AI integrations, as the boundary between AI-generated guidance and system-level execution remains a primary target for exploitation.