Full Breakdown
Microsoft Copilot Personal Vulnerability “CoSnitch” Exposes Auto-Execution Flaw
8/18/2026, 8:26:33 PM
Core Event: Researchers Coerce Copilot into Disclosing Exploit Details
Varonis Threat Labs demonstrated that Microsoft Copilot Personal can be tricked into revealing its own attack surface. By repeatedly asking the assistant why a prompt-injection would fail, the team forced Copilot to disclose a previously undocumented URL parameter, `autorun=1`, and the conditions under which it executes a pre-filled prompt without user interaction. Using the combined parameters `?q=` and `?autorun=1`, the researchers crafted a malicious URL that, when opened in an authenticated session, can execute arbitrary commands and exfiltrate data.
Background & Context: URL Parameters and Prompt-Injection Risks
The issue traces back to the `?q=` query parameter in Copilot’s web interface, which originally allowed injected text to be passed directly to the model. Microsoft later “silently” disabled this parameter to harden the assistant against prompt-injection attacks. Varonis noted that, despite the block, Copilot still described an undocumented `autorun=1` flag that could bypass the user-intent check, exposing a deeper architectural flaw in how the AI treats system instructions versus raw data.
Data & Statistics: Technical Elements of the Attack
- Vulnerability reported to Microsoft in December 2025.
- Exploit URL format: `https://copilot.microsoft.com/?q=&autorun=1`.
- Successful execution can grant an attacker access to the victim’s session context, Outlook messages, Gmail, Google Drive, Google Calendar, and Copilot’s own chat history.
- The attack chain can also poison the assistant’s memory, enabling future disinformation injections.
Official Statements & Responses
Varonis said Microsoft planned to issue a patch and formally assign a CVE identifier on the upcoming Tuesday. The Register reached out to Microsoft for comment on the fix and CVE number but had not received a response before publication.
Verbatim Quotes
- “These novel attack chains do more than just exfiltrate user data. I tricked the assistant into leaking sensitive internal parameters and configuration details,” — Lior Adar, senior security researcher at Varonis
- “When an AI reads an untrusted email or shared doc containing hidden prompts, it executes them as legitimate commands,” — Lior Adar, senior security researcher at Varonis
