Copilot Talked Researchers Through Hacking Itself

Researchers at Varonis Threat Labs got Microsoft Copilot to explain how to attack Microsoft Copilot. By repeatedly asking the assistant why a given attack should be impossible, they coaxed it into naming an undocumented URL parameter of its own — and that parameter turned out to be the first link in a chain that could drain a victim's Gmail, Drive and Calendar from a single click.

The flaw, which Varonis calls CoSnitch and Microsoft tracks as CVE-2026-24301, affects Copilot Personal. It combines three weaknesses. The ?autorun=1 parameter, paired with the ordinary ?q= query parameter, caused Copilot to execute an embedded prompt on page load without asking the user to confirm. The injected prompt then ran inside the victim's authenticated session, where it could reach OAuth-connected services and encode whatever it found into a URL. Copilot's own web-fetch capability delivered that URL to an attacker-controlled webhook — traffic that looks, to a monitoring system, like the assistant browsing the web.

The third component is the one that outlives the click. A malicious page, once summarized by Copilot, could write attacker instructions into the assistant's persistent memory store. Varonis reports that such an injection survives password changes, session revocation and device re-enrollment, which means an attacker who lands it once retains influence over every subsequent conversation. The same channel supports reconnaissance and disinformation, not just theft.

The discovery method is as notable as the bug. Varonis describes it as meta-hacking: rather than fuzzing endpoints, the researchers social-engineered the model, reframing security questions until Copilot volunteered architectural detail and undocumented parameters in the course of arguing that the attack could not work. Researcher Lior Adar told The Register the episode points to deeper architectural problems that could carry into corporate AI deployments.

Varonis reported the issue in December 2025 and disclosed publicly on August 18, with Microsoft's fix landing this week. Microsoft's statement was terse: it credited the coordinated disclosure and said customers "are already protected and do not need to take any action." Varonis says it has seen no evidence of exploitation in the wild — though an eight-month gap between report and patch is a long window for a one-click, no-confirmation data-exfiltration path.

The defensive lesson generalizes past this CVE. An assistant wired into a user's mail, files and calendar is a privileged insider with a very large blast radius and no instinct for suspicion, and every capability that makes it useful — reading pages, fetching URLs, remembering things — is also a channel an attacker can borrow. OpenAI reached a similar conclusion when it shipped a lockdown mode for ChatGPT. Auditing which connectors an assistant can actually reach, and confirming that security monitoring covers its outbound requests at all, is now basic hygiene rather than paranoia.