Microsoft Copilot Vulnerability 'CoSnitch' Allows AI to Reveal Its Own Hacking Methods
Researchers discovered 'CoSnitch,' a vulnerability in Microsoft Copilot Personal, enabling prompt injection attacks that trick the AI into revealing its own security flaws and executing malicious commands.
Security researchers at Varonis Threat Labs have uncovered a novel vulnerability within Microsoft Copilot Personal, dubbed "CoSnitch," which allows for sophisticated prompt injection attacks. The exploit method, termed "meta-hacking," involves social engineering the AI's reasoning engine to disclose its own weaknesses. Unlike traditional exploits requiring reverse engineering, CoSnitch leverages the AI's conversational nature, prompting it to reveal an undocumented parameter that facilitates malicious actions.
The vulnerability stems from a previously disabled URL query parameter, ?q=, which once allowed direct injection of text into Copilot's input field for automated queries. Microsoft had disabled this feature to enhance security. However, by persistently questioning Copilot about why auto-execution of prompts was impossible, Varonis researchers were able to elicit detailed technical explanations from the AI itself. This included the revelation of an undocumented autorun=1 parameter.
According to Varonis, Copilot disclosed that under specific session conditions, the autorun=1 parameter, when combined with the ?q= parameter, enables a prompt to execute automatically upon page load. Crucially, this occurs without any user interaction or visible confirmation within the user interface. The AI also detailed its own content filtering mechanisms and explained why the parameter was thought to be defunct, inadvertently providing the exact blueprint for its exploitation.
Armed with this information, Varonis researchers crafted a malicious URL incorporating both parameters: https://copilot.microsoft.com/?q=&autorun=1. When a victim clicks this link, Copilot loads within their authenticated session, and the embedded parameters trigger the automatic execution of a pre-defined prompt. This bypasses the need for user consent or awareness, making it a potent tool for attackers.
The potential impact of CoSnitch is significant. Attackers can leverage this vulnerability to exfiltrate sensitive data by crafting prompts that interact with OAuth connectors to services like Gmail and Google Drive. Furthermore, the exploit can be used to poison Copilot's persistent memory, perform reconnaissance on connected applications and files, or even inject disinformation by altering what the AI presents to the user in future sessions.
Examples of malicious prompts include instructing Copilot to search an inbox for specific information, extract sender details, and then construct a webhook URL to exfiltrate that data. Attackers could target emails for credentials or search Google Drive for sensitive files. The exploit essentially manipulates Copilot into performing actions it was designed to do—accessing user data—but under the direction of an attacker.
Lior Adar, senior security researcher at Varonis, emphasized that such vulnerabilities highlight "deep architectural flaws that can carry over directly into corporate environments," even when discovered in a personal AI product. The ability for an AI to leak its own internal parameters and configuration details provides attackers with a roadmap for exploiting similar systems.
Microsoft was reportedly planning to issue a patch and formally assign a CVE identifier for the CoSnitch vulnerability. This discovery underscores the evolving threat landscape of AI security, where the very nature of conversational AI can be turned against its users if not adequately secured.