Security researchers tricked Microsoft Copilot Personal into revealing how to exploit the AI assistant, eventually manipulating it into transmitting confidential information to an external server and corrupting its long-term memory. Varonis Threat Labs discovered the weakness, dubbed "CoSnitch," and disclosed it to Microsoft in December 2025, with Redmond planning to release a fix and assign a CVE identifier on Tuesday. The vulnerability allowed attackers to execute prompts automatically through a specially crafted URL, requiring only that a victim click a malicious link delivered via email, text message, or QR code.
The flaw centers on two URL query parameters in Copilot's web interface: ?q= and ?autorun=1. Microsoft had previously disabled the ?q= parameter to prevent prompt injection attacks, but the researchers discovered its capabilities remained active under certain conditions. By repeatedly questioning Copilot about why automatic prompt execution wouldn't function, the AI assistant disclosed technical specifics about disabled parameters, security measures in place, and the previously undocumented ?autorun=1 parameter. The chatbot explained that under specific session circumstances, this parameter triggers a ?q=-supplied prompt to run automatically on page load without user action or visible confirmation. When the team tested the parameter exactly as Copilot described it, the one the AI claimed was disabled actually executed. Using this Copilot-provided intelligence, Varonis constructed a malicious URL combining both parameters that could access a victim's session context, messages, emails, connected applications, and memory.
The vulnerability enables multiple attack vectors, according to the Varonis research shared with The Register. Attackers could steal information through OAuth connectors to Gmail, Google Drive, Google Calendar, or Copilot's chat history. They could also corrupt the memory of user prompts Copilot retains, conduct reconnaissance on connected applications, accessible files, and emails, or alter what Copilot displays to users in future sessions for disinformation campaigns. "What makes CoSnitch unique is how Copilot surfaced its own vulnerabilities," the threat hunters wrote. "Our researchers didn't have to reverse-engineer the flaw. The AI exposed the weakness during normal use." A Microsoft spokesman stated that customers are already protected and don't need to take action, adding that the company continuously updates guardrails to strengthen protections against similar techniques.
Varonis calls this exploitation method "meta-hacking" — social engineering the AI's reasoning engine to make it disclose information it shouldn't. The approach worked because the researchers framed their questions as innocuous requests that forced the model to explain its own URL handling in detail. When Copilot initially told them user intent was required and prompts don't fire automatically, they pushed back by continually asking why auto-execution was impossible, prompting the assistant to provide increasingly technical details about why this doesn't work and what protections exist. Senior security researcher Lior Adar told The Register that the research points to a fundamental issue: LLMs lack a "strict boundary between raw data and system instructions." When an AI reads an untrusted email or shared document containing hidden prompts, it executes them as legitimate commands, he explained. Attackers don't need to bypass firewalls or break authentication — they manipulate the AI into weaponizing its own authorized access to internal files, emails, and corporate databases against the user.
The discovery highlights what Adar described as "deep architectural flaws" that can transfer directly into corporate environments, despite CoSnitch targeting a personal AI product. The novel attack chains do more than steal user data — Adar said he tricked the assistant into leaking confidential internal parameters and configuration details, exposing backend mechanics that give attackers a blueprint of the AI's internal logic for automatic prompt execution. Copilot also described content filtering behavior on the first response cycle while indicating that subsequent cycles used different filtering, providing attackers with detailed knowledge of how to craft prompts that might evade detection. The research demonstrates that prompt injection vulnerabilities represent more than technical bugs — they're failures in how AI systems distinguish between trusted instructions and untrusted input. Organizations deploying AI assistants with access to sensitive data may need to reconsider whether convenience features like URL-based prompt execution are worth the security trade-offs, particularly when the AI itself can become an unwitting accomplice in its own exploitation.