Microsoft issued a patch on Tuesday for a critical security vulnerability in the personal version of its AI assistant, Copilot, almost eight months after confirming the flaw. The vulnerability, dubbed CoSnitch, was discovered by security firm Varonis and allows one-click data exfiltration from enterprises. The patch closes a hole that Varonis reported to Microsoft on December 31, though Microsoft had already patched one element of the attack chain on February 1.
The CoSnitch Attack Chain
CoSnitch is the third Copilot bug Varonis reported to Microsoft this year, following Reprompt and SearchLeak. Reprompt bypassed Copilot guardrails by repeating queries, while SearchLeak turned Microsoft 365 Copilot Enterprise into "a silent exfiltration tool." All three bugs share the same exploit pattern: one click on a legitimate-looking link is enough.
The vulnerability relies on the LLM's inability to distinguish data in a query from an instruction. CoSnitch itself relies on an attacker leveraging three different Copilot flaws working together.
The first flaw is automatic prompt execution. A "?q=" URL parameter combined with an undocumented parameter causes an attacker-supplied prompt to execute instantly on page load. No click, no confirmation, no user action is required.
The second flaw is data exfiltration to external servers. An injected prompt can query a victim's connected apps, including Gmail, Drive, Calendar, and OneDrive. It encodes results into a URL and exfiltrates them via Copilot's built-in URL-fetch capability to an attacker-controlled webhook.
The third flaw is persistent memory poisoning via web summarization. A crafted webpage, when summarized by Copilot, injects attacker instructions into a victim's permanent memory store. That injection survives password changes, session revocation, and device re-enrollment.
Varonis discovered CoSnitch by prompting Copilot to explain why auto-execution was impossible. Each refusal came with technical justification mapping the architecture. The researchers reframed every refusal as a follow-up question, and each answer narrowed the attack surface further. At one point, Copilot disclosed the undocumented URL parameter unprompted, mid-refusal, including its historical behavior and protections. Varonis built the URL exactly as described, and the prompt executed automatically with no click or confirmation.
"Copilot wasn't breached; it was played," Varonis said in a statement.
Microsoft's Response and the Patch Timeline
Microsoft confirmed the flaw and fix via email statement. "Our customers are already protected and do not need to take any action. We continuously update our guardrails to strengthen our protections against similar techniques," the company said.
Microsoft also issued an MSRC disclosure labeling the hole "critical." The company's email statement said "enterprise customers using Microsoft 365 Copilot are not affected." Analysts say this is not strictly accurate. Enterprise environments often house consumer-grade Copilots from personal accounts of workforce members, meaning the personal version flaw could impact enterprise settings.
Lior Adar, senior security researcher at Varonis, noted that Microsoft patched one element of the hole, the auto-execution capability, on February 1. That patch "lowered the other vulnerabilities significantly," Adar said. But Microsoft did not complete the fix until Tuesday, nearly eight months after Varonis first reported the issue.
The timing raises questions about how vendors balance security obligations against product roadmaps. Microsoft "is in the process of moving toward a more unified Copilot experience" called Copilot Fusion. Details of Copilot Fusion began to leak last month. Enterprise CISOs are concerned that flaws in the personal version may carry over into the merged offering.
Analysts See a New Class of Threat
Mark Tauschek, VP and distinguished analyst at Info-Tech Research Group, found Varonis's methodology powerful. He described it as "very sophisticated combination of social engineering on an LLM, a variety of jailbreaks, and a prompt injection attack." Tauschek said the combination of hack vectors is what makes it more startling. All three working for one exploit is new from a disclosure perspective.
Tauschek compared the situation to macro virus days in the late 90s and early 2000s. Back then, the only way to definitively stop the threat was to turn it off, by disabling macros. His advice to CISOs is blunt: "Disable Copilot now."
Stay ahead of the AI curve
The most important updates, news, and content — delivered weekly.
No spam. Unsubscribe anytime.
"There are many mitigation steps that can reduce risk to negligible, but that's not zero. The point is, it's just the beginning," Tauschek said.
Chen Levy Ben Aroy, Varonis Cloud Security Research Team leader, put the problem in stark terms. "LLMs are a whole new world of vulnerabilities," she said.
The Business Incentive Problem and Memory Poisoning
Aman Mahapatra, chief strategy officer for Tribeca Softtech, a NYC-based technology consulting firm, argued that financial incentives for major AI companies will make meaningfully fixing these holes almost impossible. Every guardrail that fully closes this class of attack degrades the product, he said. "The fix and the feature are in direct tension," Mahapatra said.
The eight-month window between report and patch is what it looks like when a vendor negotiates between security obligation and product roadmap, Mahapatra said. These vulnerabilities will not be cleanly patched but perpetually mitigated.
Mahapatra pointed to a deeper structural issue. "In agentic systems, the malicious action and the legitimate action are the same action with different intent," he said. That collapses the signature-and-anomaly detection model that enterprise security has been built on for twenty years.
"CoSnitch is serious, but its defining property is that nothing was broken," Mahapatra said. The three chained flaws are the autorun URL parameter firing a prompt with no click, OAuth connector abuse reading full Gmail bodies rather than metadata, and persistent memory poisoning through web summarization. Every one of these is Copilot doing exactly what it was designed to do.
Mahapatra singled out the memory-poisoning component as the one being undersold and the most dangerous. A single summarized webpage writes attacker instructions into persistent memory. That memory survives password changes, session revocation, and device re-enrollment. Every standard incident response step leaves the injection intact.
The attacker needs no persistent infrastructure after the initial write. Every future session runs under attacker-controlled context. The injection is recorded only in the memory settings UI, which almost no user has ever opened.
Flavio Villanustre, CISO for LexisNexis Risk Solutions Group, pointed to the bigger-picture issue. The prompt injection is based on the LLM's inability to differentiate between data, such as an unsafe data stream from an external web page, and instructions embedded in that data stream by an attacker.
Villanustre called for a different architectural approach to LLMs, one that separates data and instructions. "This is not something that Microsoft or any other AI vendor has addressed to date," he said.
What CISOs Should Do Now
The patch addresses the specific CoSnitch chain, but analysts stress the underlying class of vulnerability remains open. Microsoft's claim that enterprise customers are unaffected does not account for the reality that consumer-grade Copilot instances sit inside many corporate networks through personal accounts.
With Copilot Fusion on the horizon, the question is whether the merged product inherits the same architectural weaknesses. Varonis has now demonstrated three distinct attack chains against Copilot this year, all sharing the same one-click exploit pattern.
Tauschek's recommendation stands as the most direct guidance for security teams. "Disable Copilot now," he said. The mitigation steps can reduce risk, but they cannot eliminate it. As he put it, "it's just the beginning."