GoKawiilThreat actors can trick a Copilot instance into giving up details about its own architecture, paving the way for a novel prompt injection attack.
That's according to Varonis Threat Labs, which today published new research regarding a set of security issues it collectively called "CoSnitch." As blog author and senior security researcher Lior Adar put it, Varonis threat labs socially engineered a Microsoft Copilot Personal instance to reveal critical security-related details. This ultimately revealed what Varonis described as a chain of vulnerabilities enabling memory poisoning, automatic prompt execution through a specially crafted URL, and data exfiltration. Adar described this element of CoSnitch as "meta-hacking."
Varonis reported CoSnitch to Microsoft in December 2025, and patches were shipped on Aug. 18, following a coordinated disclosure process between the two companies. Varonis has seen no evidence that the attack has been exploited in the wild.
Related:Hugging Face Breach Raises Big Questions About AI Security Controls
A Microsoft spokesperson tells Dark Reading that no customer action is required, and enterprise customers are unaffected by CoSnitch (it only affected Copilot Personal). Moreover, Microsoft assigned CVE-2026-24301 to this issue, an information disclosure vulnerability related to Copilot, and rated it 8.8 under CVSS 3.1.
"We appreciate Varonis Threat Labs for reporting this through a coordinated vulnerability disclosure. Our customers are already protected and do not need to take any action," the spokesperson tells Dark Reading in a statement. "We continuously update our guardrails to strengthen our protections against similar techniques."
How Meta-Hacking and CoSnitch Work
Varonis researchers began by asking Copilot how prompts could be executed without direct user interaction. The chatbot repeatedly explained that prompts require user intent, but in doing so divulged technical details about its own behavior. By posing a series of seemingly innocuous follow-up questions about URL structures, deep links, and prompt handling, researchers gradually mapped portions of Copilot's architecture and identified a potential attack path.
As Varonis's blog post explained, Copilot revealed that prompts could be supplied through URL parameters and that a combination of parameters could cause a prompt to execute automatically when the page loaded. Researchers then built a specially crafted link using these parameters that could get past Microsoft's pre-existing guardrails, without further user interaction. It's an otherwise normal Copilot link (copilot dot Microsoft dot com) with "/?q=<malicious_prompt>&autorun=1*" after.
Related:Amid AI-Driven Bug-Hunt Tsunami, NIST Looks to … AI
... continue reading