Researchers trick Microsoft Copilot into revealing how to hack itself through URL manipulation

Varonis Threat Labs discovered a critical vulnerability in Microsoft Copilot Personal, dubbed CoSnitch, which allows attackers to exfiltrate sensitive user data and poison persistent memory. By employing a 'meta-hacking' technique, researchers tricked the AI into revealing an undocumented parameter, `autorun=1`. This parameter enables automatic prompt execution via crafted URLs without user interaction, exposing emails, credentials, and connected applications.

CoSnitch vulnerability discovery

• ▪Microsoft had previously disabled the ?q= URL query parameter in Copilot's web interface to protect the AI assistant against prompt injection attacks.
• ▪Varonis Threat Labs discovered a security vulnerability in Microsoft Copilot Personal, which the researchers named CoSnitch.
• ▪Varonis Threat Labs reported the CoSnitch vulnerability to Microsoft in December 2025, with Microsoft planning to issue a patch on August 18, 2026.

Meta-hacking technique

• ▪Varonis Threat Labs used a meta-hacking technique to social engineer Microsoft Copilot's reasoning engine into disclosing its own URL handling and security protections.
• ▪Researchers bypassed Microsoft Copilot's restrictions by repeatedly asking the chatbot why auto-execution was impossible, prompting it to reveal an undocumented parameter.
• ▪Varonis Threat Labs senior security researcher Lior Adar stated that tricking Microsoft Copilot into leaking internal parameters provides attackers with a blueprint of its internal logic.

Autorun parameter exploitation

• ▪Microsoft Copilot revealed a previously undocumented parameter, autorun=1, which triggers automatic execution of a prompt on page load under specific session conditions.
• ▪Researchers crafted a malicious URL using the format https://copilot.microsoft.com/?q=&autorun=1 to execute prompts without user interaction or visible confirmation.

Data exfiltration attack scenarios

• ▪Researchers demonstrated that a prompt could instruct Microsoft Copilot to search a victim's inbox, extract sensitive data, and leak it to an attacker-controlled server.
• ▪The malicious URL allows Microsoft Copilot to execute prompts with full access to the victim's session context, connected apps, and memory.
• ▪An attacker can deliver the crafted Microsoft Copilot URL via email, chat, phishing pages, SMS, or QR codes to target a victim's active session.
• ▪To conceal data theft, the exfiltrated information was converted to base64 format and appended to a URL that Microsoft Copilot automatically opened.

Copilot memory poisoning

• ▪Varonis Threat Labs devised an attack using prompt injection embedded in a webpage to poison Microsoft Copilot's permanent memory store.
• ▪The memory poisoning attack allows attackers to forward outputs, filter information, bias responses, or execute attacker-defined actions in future Microsoft Copilot sessions.

2 sources