Artificial Intelligence & Machine Learning
,
Next-Generation Technologies & Secure Development
Varonis Calls CoSnitch Its Third Critical Copilot Exfiltration Flaw This Year
Emilia David •
August 20, 2026
Image: Shutterstock
Microsoft Copilot, Redmond’s look-everywhere-and-it’s-there artificial intelligence assistant, was happy to tell researchers how to execute a zero click hack after a series of prompts from researchers asking to explain further why such a thing could never happen.
See Also: How Skilled Attackers Weaponize AI Faster
In telling researchers why they couldn’t do it, Copilot instead disclosed a method for doing just that. Research cybersecurity firm Varonis discovered the flaw, which it dubbed CoSnitch – the third critical flaw it found in Copilot this year alone. Varonis said this type of vulnerability may not be limited to only Copilot.
Varonis said it was able to get Copilot to open up by deploying meta-hacking, “aka social engineering the reasoning engine itself.”
“Each ‘that won’t work because…’ is an invitation to probe the ‘because.’ You don’t exploit the model. You manipulate it into cooperating,” Varonis researchers wrote. Meta-hacking is a meaningful shift in how security flaws are unearthed, the company said, “and a preview of what’s ahead as AI gets woven deeper into enterprise systems.”
Varonis earlier this year identified Reprompt, a way to bypass safety controls through a single click on a legitimate Microsoft link by basically asking a question twice, and SearchLeak, which chains several bugs together to remove data.
Varonis said it disclosed CoSnitch to Microsoft back in December 2025, but the company only shipped patches on Aug. 18. Microsoft responded to a query by stating that “our customers are already protected and do not need to take any action. We continuously update our guardrails to strengthen our protections against similar techniques.”
Varonis senior security researcher Lior Adar told ISMG in an email that his team is currently looking at the same methods across multiple AI platforms. “Meta-hacking isn’t a Copilot-specific trick. It’s a technique that works against any AI system with a natural language interface that’s willing to reason about its own architecture,” Adar said.
The researchers said they discovered CoSnitch by reframing questions posed to Copilot so they looked like follow-up questions.
First, Varonis researchers prompted Copilot to explain why auto-execution was impossible. The model refused the request but included technical justifications that helped researchers map out its architecture. They then reframed the refusal as a follow-up question to narrow the attack surface before Copilot disclosed an undocumented URL parameter. This URL parameter appeared unprompted and included historical behavior and protections that allowed Varonis to find the CoSnitch vulnerability.
“The model snitched on itself because it was designed to explain things clearly. Providers need to rethink how much their AI is allowed to reason about its own internals. URL parameters, disabled features, architectural decisions,” Adar said.
This is not the first time researchers have found flaws in Copilot and other connected coding agents, including one that allowed attackers to steal source code using GitHub Copilot’s image repository.
Varonis said that during its tests, Copilot sounded confident in its safety mechanisms, then disclosed how to compromise them.
Varonis noted three vulnerabilities that made CoSnitch possible: automatic prompt execution where adding the ?q=URL parameter combined with an undocumented parameter allows attacker-supplied prompts to execute upon opening the page, data exfiltration through queries on Copilot connected apps such as Gmail, Google Drive or OneDrive, and persistent memory poisoning via web summarization that injects and embeds the attacker instructions into the users’ permanent memory store.
Once someone clicks the attacker-crafted link that takes advantage of the undocumented parameter Copilot generated, it accesses the victim’s authenticated session to read real messages and files. As a result, the exfiltration looks like normal traffic.
Adar said none of these vulnerabilities and the technique of meta-hacking is unique to Copilot because platforms like Claude or ChatGPT can fall victim to similar reasoning social engineering.
“What I will say is that across the industry, the fundamental challenge is the same: these systems don’t separate content from instructions,” Adar said.
He added that an architectural gap exists “that no amount of prompt-level will close” because separating data from instructions has to happen at the system level.
Varonis said organizations shouldn’t stop using chat platforms. Instead, security teams need to review connected apps to reduce the blast radius, apply access review and anomaly detection to Copilot and other chat platforms as they do for human employees, and add additional security to AI-generated links and verification monitoring.