Microsoft addressed this issue on August 18, 2026, following Varonis\u2019s responsible disclosure in December 2025. According to Varonis, there is currently no evidence of exploitation in the wild.<\/p>\n
Microsoft Copilot CoSnitch Flaw<\/p>\n
CoSnitch highlights the risks associated with an AI assistant having broad access to a user\u2019s email, cloud files, calendar, chat history, and persistent memory. <\/p>\n
Instead of exploiting a traditional software bug in applications like Gmail or Google Drive, the attack leverages Copilot\u2019s ability to perform legitimate actions on behalf of an authenticated user.<\/p>\n
The attack commences when a victim opens a specially crafted Copilot link delivered through phishing emails, chat messages, malicious web pages, or QR codes. <\/p>\n
Researchers discovered that an undocumented URL parameter could cause a provided prompt to execute as the Copilot page loaded, bypassing the normal requirement for a user to submit the request manually.<\/p>\n
![\"Copilot](\"https:\/\/www.europesays.com\/ai\/wp-content\/uploads\/2026\/08\/CoSnitch-2-final.webp\")
Copilot extracting email body content, including plaintext credentials from connected Gmail (Source: Varonis)<\/p>\n
Once activated, the prompt inherits the victim\u2019s authenticated Copilot session and the permissions granted to the connectors. It can then instruct Copilot to search linked services, retrieve relevant content, and send the results to an external endpoint using its built-in web-fetching or URL-summarization functionality.<\/p>\n
Varonis\u2019s research demonstrated<\/a> the ability to access data from connected Gmail or Outlook accounts, Google Calendar, Google Drive, Copilot chat history, and the assistant\u2019s persistent memory. Potentially exposed information includes email content, sender and recipient details, meeting information, file metadata, saved user preferences, and previous chat data.<\/p>\n The exfiltration technique relied on Copilot\u2019s routine capability to retrieve and summarize external URLs. A malicious prompt could gather data into the model\u2019s active context, encode it for URL transport, and instruct Copilot to request an attacker-controlled URL containing the encoded information.<\/p>\n From a network monitoring perspective, this outbound request could resemble a standard HTTPS fetch that Copilot typically performs during normal web summarization. This reduces visibility for traditional security controls that focus on identifying suspicious processes, unusual ports, or anomalous network destinations.<\/p>\n The key security failure was not unauthorized OAuth access; rather, the victim had already granted Copilot access to the connected application. CoSnitch removed the expectation that connector actions would occur only in response to an intentional user request.<\/p>\n The third component involved indirect prompt injection via web summarization. An attacker could host a seemingly benign webpage with concealed instructions embedded in HTML comments, metadata, or visually hidden elements.<\/p>\n When a victim asked Copilot to summarize that page, the service would retrieve the entire content and process both the visible text and the hidden attacker-controlled instructions. Varonis found that this could cause Copilot to write malicious instructions into the user\u2019s persistent memory.<\/p>\n This memory poisoning presents a significant long-term risk, as injected instructions may remain active across future sessions until manually removed. A compromised memory entry could alter Copilot\u2019s responses, suppress warnings, distort summaries, or trigger future actions based on attacker-defined conditions.<\/p>\n Unlike traditional endpoint malware, this persistence mechanism exists within the AI assistant\u2019s user context. Password resets, session revocations, or device re-enrollment may not eliminate a poisoned memory record.<\/p>\n Varonis described its discovery process as \u201cmeta-hacking.\u201d Researchers prompted Copilot to explain why automatic execution should not be possible. <\/p>\n Then they used its technical explanations to narrow the attack surface. They stated that Copilot disclosed implementation details regarding URL behavior and historical protections while outlining its limitations.<\/p>\n CoSnitch is the third flaw in Microsoft Copilot reported by Varonis this year, following Reprompt and SearchLeak<\/a>. Together, these findings emphasize how AI platforms can centralize access to valuable enterprise data behind a single conversational interface.<\/p>\n Organizations should implement Microsoft\u2019s security updates, review Copilot connector permissions, restrict unnecessary third-party integrations, monitor AI-related outbound requests, and educate employees on the risks of links that open AI assistants with pre-populated instructions.<\/p>\n