Informa TechTarget | SearchSecurity Cybersecurity Dive InformationWeek Channel Dive Explore our brands Dark Reading Resource Library Black Hat News Omdia Cybersecurity Advertise NEWSLETTER SIGN-UP Cybersecurity Topics World The Edge DR Technology Events Resources VULNERABILITIES & THREATS APPLICATION SECURITY СLOUD SECURITY DATA PRIVACY NEWS 'CoSnitch' Attack Tricked Copilot into Mapping Out Architecture Researchers discovered a "meta-hacking" technique that can manipulate the AI service into revealing its own security weaknesses. Alexander Culafi,Senior News Writer,Dark Reading August 18, 2026 4 Min Read SOURCE: ALEXSL VIA G Threat actors can trick a Copilot instance into giving up details about its own architecture, paving the way for a novel prompt injection attack. That's according to Varonis Threat Labs, which today published new research regarding a set of security issues it collectively called "CoSnitch." As blog author and senior security researcher Lior Adar put it, Varonis threat labs socially engineered a Microsoft Copilot Personal instance to reveal critical security-related details. This ultimately revealed what Varonis described as a chain of vulnerabilities enabling memory poisoning, automatic prompt execution through a specially crafted URL, and data exfiltration. Adar described this element of CoSnitch as "meta-hacking." LOADING... Varonis reported CoSnitch to Microsoft in December 2025, and patches were shipped on Aug. 18, following a coordinated disclosure process between the two companies. Varonis has seen no evidence that the attack has been exploited in the wild. Related:Hugging Face Breach Raises Big Questions About AI Security Controls A Microsoft spokesperson tells Dark Reading that no customer action is required, and enterprise customers are unaffected by CoSnitch (it only affected Copilot Personal). Moreover, Microsoft assigned CVE-2026-24301 to this issue, an information disclosure vulnerability related to Copilot, and rated it 8.8 under CVSS 3.1. "We appreciate Varonis Threat Labs for reporting this through a coordinated vulnerability disclosure. Our customers are already protected and do not need to take any action," the spokesperson tells Dark Reading in a statement. "We continuously update our guardrails to strengthen our protections against similar techniques." How Meta-Hacking and CoSnitch Work LOADING... Varonis researchers began by asking Copilot how prompts could be executed without direct user interaction. The chatbot repeatedly explained that prompts require user intent, but in doing so divulged technical details about its own behavior. By posing a series of seemingly innocuous follow-up questions about URL structures, deep links, and prompt handling, researchers gradually mapped portions of Copilot's architecture and identified a potential attack path. As Varonis's blog post explained, Copilot revealed that prompts could be supplied through URL parameters and that a combination of parameters could cause a prompt to execute automatically when the page loaded. Researchers then built a specially crafted link using these parameters that could get past Microsoft's pre-existing guardrails, without further user interaction. It's an otherwise normal Copilot link (copilot dot Microsoft dot com) with "/?q=<malicious_prompt>&autorun=1*" after. Related:Amid AI-Driven Bug-Hunt Tsunami, NIST Looks to … AI According to Varonis, prior to Microsoft's fix, the undocumented "?autorun=1" parameter could cause Copilot to automatically execute the embedded prompt when paired with a query parameter. The attacker would send this link to the victim, and once the victim clicked, the embedded command could act within the victim's authenticated session and retrieve information from connected services like Gmail, Google Drive, Google Calendar, Copilot memory, and Copilot chat history. In addition to straight data exfiltration, a malicious prompt could also cause persistent memory poisoning, be used for reconnaissance, inject disinformation (to influence future prompts), and other malicious actions. Every AI Assistant is a Privileged Insider While the data exfiltration and memory poisoning aspects enabled by CoSnitch are notable, the most novel aspect of the research is the meta-hacking component. It's a reminder that prompt injection attacks remains a problem of the here and now. Adar tells Dark Reading that even though the issue has been addressed by Microsoft, meta-hacking remains the most concerning element of the attack chain going forward. Varonis talked to Copilot and "it handed us the keys," the researcher says. Related:Global Threat Campaign Hits Critical VMware vCenter Flaw Even if this issue didn't impact enterprise customers in the traditional sense, these "personal" products could still have been hooked up to enterprise data, greatly expanding the potential blast radius. "The specific vulnerabilities we found are in the Personal version, that's correct. But the person using Copilot Personal is the same person who walks into your office Monday morning," Adar explains. "They could have corporate emails forwarded to personal Gmail, credentials shared over personal accounts, work docs in a personal Drive. So when CoSnitch exfiltrates from a personal inbox, the data it pulls is often enterprise data. A stolen password from a personal account becomes a foothold in your corporate tenant." He adds, however, that this isn't solely a Microsoft issue. The pattern of broad data access, assumed user intent, and a lack of separation between instructions and data continues to pops up across various vendors and products. "Every enterprise AI assistant is a privileged insider with no security awareness and should be treated like one," Adar says. "Audit connectors, minimize access, and assume the trust boundary between legitimate and injected prompts will be broken." About the Author Alexander Culafi Senior News Writer, Dark Reading Alex is an award-winning writer, journalist, and podcast host based in Boston. After cutting his teeth writing for independent gaming publications as a teenager, he graduated from Emerson College in 2016 with a Bachelor of Science in journalism. He has previously been published on VentureFizz, Search Security, Nintendo World Report, and elsewhere. At Dark Reading, he covers a variety of cybersecurity topics, including the cybercrime ecosystem, open source security, and the intersection between AI and threat actors. In his spare time, Alex hosts the weekly Nintendo podcast, "Talk Nintendo Podcast," and works on personal writing projects, including two previously self-published science fiction novels. He has received numerous awards, including TechTarget's Writer of the Year in 2022 as well as more than 10 Azbee awards for his reporting between 2022 and today. Want more Dark Reading stories in your Google search results? ADD US NOW More Insights Industry Reports The State of Cloud Security: The Latest Challenges How Organizations Are Managing Incident Response How Enterprises Are Developing Secure Applications Inside RSAC 2026: security leaders reveal the risks redefining your defense strategy Essential News & Insights from Black Hat USA 2025 Access More Research Webinars What Every Enterprise Should Know About Securing Cloud Assets In the Age of AI The Dos and Don'ts of a Cybersecurity Awareness Month People Actually Remember Building a Secure AI Strategy for the Enterprise Is your AppSec program Mythos Ready? Experts Explain How to Develop a Framework for Cyber-Fraud Fusion More Webinars You May Also Like VULNERABILITIES & THREATS Cheap Hardware Module Bypasses AMD, Intel Memory Encryption by Rob Wright NOV 25, 2025 VULNERABILITIES & THREATS Patch Now: Microsoft Flags Zero-Day & Critical Zero-Click Bugs by Jai Vijayan NOV 11, 2025 VULNERABILITIES & THREATS Microsoft Issues Emergency Patch for Critical Windows Server Bug by Rob Wright OCT 24, 2025 VULNERABILITIES & THREATS 'ShadowLeak' ChatGPT Attack Allows Hackers to Invisibly Steal Emails by Nate Nelson SEP 19, 2025 Featured Check out the Black Hat USA 2026 Conference Guide for coverage and intel from — and about — the show. Editor's Choice CYBERSECURITY OPERATIONS From Bobmojis to Bobbleheads: How the Democratic Party Built a Security-First Culture byArielle Waldman AUG 6, 2026 4 MIN READ APPLICATION SECURITY Microsoft's Patch Tuesday Deluge Continues With August Updates byJai Vijayan AUG 11, 2026 4 MIN READ CYBERATTACKS & DATA BREACHES Ransomware Hits Colombian Justice Ministry Days Before Presidential Transition byRobert Lemos AUG 12, 2026 4 MIN READ Want more Dark Reading stories in your Google search results? LOADING... Keep up with the latest cybersecurity threats, newly discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox. SUBSCRIBE Discover More Black Hat Omdia Working With Us About Us Meet the Editors Advertise Reprints Join Us NEWSLETTER SIGN-UP Follow Us Copyright © 2026 TechTarget, Inc. d/b/a Informa TechTarget. This website is owned and operated by Informa TechTarget, part of a global network that informs, influences and connects the world’s technology buyers and sellers. All copyright resides with them. Informa PLC’s registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. TechTarget, Inc.’s registered office is 275 Grove St. Newton, MA 02466. Home| Cookie Policy| Privacy| Terms of Use Your Privacy Choices