Microsoft has patched a Copilot vulnerability that allowed prompts embedded in a URL to run without another action from the user. Varonis Threat Labs identified the issue after Copilot disclosed technical details about its own safeguards during a series of follow-up questions.
The flaw, named CoSnitch, could bypass an expected user confirmation and execute instructions within an authenticated Copilot session.
Separate testing found that hidden instructions in webpage content could alter Copilot’s persistent memory. CoSnitch was reported to Microsoft in December 2025 and addressed under CVE-2026-24301, with no reported exploitation in the wild.
Why It Matters: CoSnitch shows how an AI assistant can create security risks in ways that existing controls may not account for. Copilot revealed details about how its safeguards worked, which helped identify a way around them. For enterprise AI deployments, security reviews may need to consider what assistants disclose about their own systems and whether that information could be used to uncover other weaknesses.
- Copilot Disclosed Details About Its Safeguards: Copilot provided information about its handling of pre-filled prompts, automatic execution, and the conditions governing those features. The responses included undocumented functionality that Varonis tested and found could bypass the expected user confirmation.
- Opening A Link Could Start The Prompt: With that functionality identified, Varonis was able to craft a Copilot URL that executed supplied instructions when opened in an authenticated session. The user did not have to manually submit the prompt, so a link delivered through email, chat, a webpage, or a QR code could initiate the process once opened. Microsoft restricted the affected URL functionality in February and later released additional fixes under CVE-2026-24301.
- Existing Permissions Determined What The Prompt Could Reach: Once executed, the prompt could work with information available through the user’s Copilot session and connected applications. Varonis demonstrated instructions that retrieved selected data and transferred it to an external service through a URL request. The amount of data exposed depended on the access Copilot already had within the user’s session.
- Web Content Could Alter Persistent Memory: Varonis found another avenue through instructions hidden in webpage content. When Copilot was asked to summarize the page, it could process the embedded instructions and save information to persistent memory, where it remained available in later sessions.
- Longer Conversations Can Expose Internal Details: Copilot initially blocked the attempted action, but follow-up questions revealed information about the controls behind that decision. Those details became useful when combined and tested against the application. Security testing that follows an AI’s explanations over multiple exchanges can help identify cases where seemingly routine responses disclose enough information to find a way around a safeguard.
Go Deeper -> Microsoft Copilot reveals secret input that allowed it to be hacked – arstechnica
Microsoft patches a flaw that forced Copilot to give away its weaknesses – cybernews
Copilot tricked into telling reseachers how to hack itself – The Register
