When you purchase through links on our site, we may earn an affiliate commission. Here’s how it works.
Microsoft’s Copilot AI just told a group of researchers how to abuse it for data exfiltration, and it worked. It was not a straightforward process, and the AI did not turn “evil”, but one might say it is gullible and somewhat naive.
Security firm Varonis has published a new report outlining its discovery of a vulnerability in Copilot they named CoSnitch.
The name is a major hint at what the vulnerability is – as CoSnitch is a chain of three vulnerabilities which Microsoft later labeled as CVE-2026-24301, giving it a severity score of 8.8/10 (high), and fixing it with a patch.
Cybercriminals have long been using AI as part of their arsenal, as it helps them draft convincing phishing emails, write malicious code, and identify high-value targets – and developers have responded by placing guardrails, which making AI outright refuse to do certain things.
In the report, Varonis said its researchers did not hunt for bugs in the code or try to reverse-engineer an existing exploit. They just talked to the AI, and with each subsequent question, learned more about its guardrails and how they work. They called the technique “meta-hacking”.
Whenever Copilot declined a request, it explained why, giving the researchers snippets of insight into how it operates. Or, as Varonis hinted, it “snitched” on itself. This, eventually, helped them map out its defenses and learn how to work around it:
“The resistance is part of the technique,” they explained. “Each “that won’t work because…” is an invitation to probe the “because.” You don’t exploit the model. You manipulate it into cooperating.”
Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!
After a long conversation with Copilot, the researchers were told, inadvertently, how to create a URL which would, as soon as it was clicked, kick off a chain reaction that resulted in sensitive data exfiltration.
So, Varonis learned that by creating a URL like this one – “https://copilot.microsoft.com/?q=&autorun=1*” – they could get Copilot to run any malicious prompt as soon as it was clicked. Threat actors could, for example, add this link in a phishing email and trick the victim into clicking on it, telling AI to send all sensitive data to the attackers’ infrastructure.
But that is only half of the challenge. In this setup, the researchers could only exfiltrate the data the victims shared with Copilot during their sessions together.
The risk escalates the moment the victim connects the AI to their apps – Gmail, Drive, Calendar, and others. As Varonis explained, the malicious prompt could tell Copilot to exfiltrate all email addresses found in Gmail, all passwords and other secrets found in the emails’ bodies, all information stored in the Drive folder, and all events logged in the Calendar.
The third part of the CoSnitch vulnerability chain is called “Persistent memory poisoning via web summarization”. As Varonis explained, attackers could craft a webpage which, when summarized by Copilot, injects attacker instructions into the victim's permanent memory store.
“The injection survives password changes, session revocation, and device re-enrollment, persisting forever,” they warned. This flaw is called “indirect prompt injection” and it is not exactly novel – it’s been observed before and stems from the fact that the AI cannot differentiate between instructions, and data to be analyzed.
