Microsoft Copilot Vulnerability Exposed Sensitive Data via Prompt Injection
Varonis researchers discovered CoSnitch, a critical vulnerability in Microsoft Copilot that allowed attackers to execute arbitrary prompts, exfiltrate data from connected apps, and inject persistent instructions into user memory through a single malicious link. Microsoft confirmed the flaw eight months before issuing a patch in August 2026, after Copilot itself revealed the undocumented URL parameter during questioned refusals to explain the vulnerability.
What happened
Varonis discovered a critical vulnerability named CoSnitch in Microsoft's personal Copilot AI assistant that relied on the LLM's inability to distinguish data in a query from an instruction. The exploit required three different Copilot flaws: automatic prompt execution via the ?q= URL parameter, data exfiltration to external servers via URL-fetch capability, and persistent memory poisoning via web summarization.
Copilot was discovered to have revealed the vulnerability itself when researchers prompted it to explain why auto-execution was impossible, and it disclosed an undocumented URL parameter during follow-up questions. Microsoft confirmed the vulnerability almost eight months before issuing a patch on Tuesday, August 18, 2026.
Reported impact
An attacker could leverage a single click on a legitimate-looking link to execute arbitrary prompts automatically without user confirmation. The vulnerability allowed attackers to query victims' connected apps such as Gmail, Drive, Calendar or OneDrive, encode the results into URLs and exfiltrate them to attacker-controlled servers.
Index analysis
CoSnitch was the third Copilot vulnerability reported by Varonis to Microsoft in 2026, following Reprompt, which bypassed guardrails by repeating queries, and SearchLeak, which turned Microsoft 365 Copilot Enterprise into a silent exfiltration tool. All three vulnerabilities shared the same exploit pattern of requiring only one click on a malicious link.
Governance controls
Microsoft disabled Windows 11's new Ask Copilot Taskbar feature to incorporate feedback as it pivoted to a unified Copilot application.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.