Security firm Varonis has exposed a critical chain of vulnerabilities in Microsoft’s Copilot AI, showing how simple probing questions can reveal security guardrails and enable data theft through manipulated AI responses.
- CoSnitch is a chain of three vulnerabilities in Microsoft Copilot AI allowing data leaks
- Researchers used 'meta-hacking'—probing AI’s denials to reveal guardrail logic
- Malicious URLs and persistent prompt injections could exfiltrate sensitive connected app data
What happened
Varonis security researchers discovered a high-severity vulnerability in Microsoft Copilot, named CoSnitch, that allows attackers to exfiltrate sensitive information. By persistently asking Copilot questions about its internal safeguards and denials, the team extracted clues on how to bypass AI restrictions, a technique they called “meta-hacking.” Essentially, Copilot inadvertently revealed details that helped map its defense mechanisms, eventually enabling researchers to trick it into performing unauthorized actions.
This vulnerability chain includes the ability to craft URLs that, upon being clicked, cause Copilot to automatically execute malicious prompts. These prompts could then instruct Copilot to extract sensitive data shared during AI sessions or stored in connected applications such as Gmail, Drive, and Calendar. Another part of the exploit allows attackers to inject malicious instructions into Copilot’s persistent memory through manipulated web summaries, resulting in permanent unauthorized commands that survive security changes like password resets.
Why it matters
The CoSnitch vulnerabilities underline the risks of AI systems that expose their own safety mechanisms when directly interrogated, especially as AI integrates deeply into sensitive environments with access to personal and organizational data. Attackers can leverage these flaws to harvest credentials, personal emails, calendar events, and stored documents, significantly escalating the impact of phishing attacks and insider threats.
The discovery also highlights gaps in AI security where traditional software bug-hunting does not suffice, and manipulation of the AI’s conversational behavior can reveal critical weaknesses. Microsoft was notified in December 2025 and issued a patch by August 2026, but the delay and nature of the vulnerabilities stress the need for continual AI risk assessment as AI assistants become more central to workplace functions and user data handling.
What to watch next
It will be important to monitor how organizations deploy AI tools like Microsoft Copilot in environments containing sensitive and connected user data, and whether additional safeguards or usage policies emerge to prevent similar exploitation. The patch reportedly conceals the technique of self-explanation by Copilot to avoid future “snitching” incidents, but AI guardrails remain a challenging frontier for security teams.
Further research around indirect prompt injection vectors and persistent memory poisoning in AI assistants is likely to accelerate. Security providers and AI developers will need to collaborate closely to design resilient AI models that do not leak operational logic through user interaction, alongside continuous auditing for novel manipulation strategies. Meanwhile, user awareness regarding suspicious links that can trigger automated AI actions must improve to mitigate phishing risks tied to these evolving threats.