Researchers Asked Copilot Why an Attack Was Impossible. It Explained Enough for Them to Build One

Copilot explained its own weakness, then researchers used it

Varonis Threat Labs disclosed CoSnitch, a chain of three flaws in Microsoft Copilot Personal tracked as CVE-2026-24301 and rated 8.8 under CVSS 3.1. One click on an ordinary-looking link was enough to run attacker-controlled prompts inside a victim's authenticated session and pull data from connected Gmail, Google Drive, Google Calendar and Copilot's own memory.

The discovery method is the part that will be quoted for years. Varonis calls it meta-hacking. Rather than reverse-engineering anything, researchers repeatedly asked Copilot why automatic prompt execution ought to be impossible. Reframing each refusal as a follow-up question, they got the assistant to explain its own URL handling and historical protections in enough detail to expose an undocumented parameter. The model declined to give harmful instructions and disclosed the architecture anyway.

The memory write produced no process, no file, no network connection and no log entry that security tooling would flag. It was visible only inside Copilot's own memory interface.

Timeline: reported December 2025, patched 18 August 2026 — about eight months. Varonis found no evidence of exploitation in the wild. Microsoft says no customer action is required and enterprise customers were unaffected, since this touched Copilot Personal only.

It is the third Copilot flaw Varonis has reported this year, after Reprompt, which bypassed guardrails by asking the same question twice, and SearchLeak, which turned Microsoft 365 Copilot Enterprise into a silent exfiltration channel. All three share one pattern: a single click on a legitimate-looking link. Full breakdown and the connector audit to run this week here.

OpenAI names a listing year

At an all-hands, CFO Sarah Friar told employees OpenAI will be a public company in 2027, or sooner if the business continues to inflect. That settles a reported internal split — Friar pressing for a 2027 listing at around a trillion dollars, against Altman pushing for a 2026 debut.

The confidential S-1 went to the SEC on 8 June. The public prospectus still has not appeared on EDGAR, and must be public at least 15 days before a roadshow. A 2027 commitment reads as the cautious path winning.

Separately, OpenAI published its own figure for what safety costs at the frontier: monitoring overhead now runs roughly 20 percent of the inference compute being monitored, covering all reinforcement learning training and tool-involving evaluations for GPT-5.6 Sol-class models and above, plus all inference on Astra. That is a real number on a question the industry usually answers in adjectives.

SpaceX is buying the coding layer

Bloomberg reports SpaceX approached Cognition, maker of the Devin coding agent, about a potential acquisition and is weighing a compute partnership. It comes days after closing its reported 60 billion dollar Cursor deal.

Read together with the Grok 4.7 delay — xAI running supplemental training on SpaceX engineering data — a picture forms. The Musk companies are assembling an engineering-specific AI stack: the model, the editor, and now possibly the agent, trained on proprietary aerospace work no other lab can touch.

Nvidia doubles down on the data layer

The Information reports Nvidia is in talks to invest in Mercor at a 20 billion dollar valuation, roughly double the 10 billion Series C nine months ago. Mercor's first-half gross revenue reached 614 million dollars against a 2 billion annualised run rate, and Nvidia itself paid Mercor tens of millions last quarter.

Worth noticing what that says about the bottleneck. The company being valued at 20 billion does not build models. It labels data for the people who do.

Also shipping

• GLM-5.3 from Z.AI, released 14 August, now appearing on gateway providers
• Gemini 3.7 Flash from Google, released 13 August

Deadlines still running

What we are watching next

Whether meta-hacking generalises. Varonis notes the technique may apply to other assistants, and the underlying weakness is structural: a model that explains its own reasoning helpfully will sometimes explain its own architecture. Every vendor shipping a reasoning-visible assistant now has the same exposure.

FAQ

Am I affected by CoSnitch?

Only if you used Copilot Personal before 18 August 2026. Microsoft says enterprise customers were unaffected and no customer action is required. Varonis found no evidence of exploitation in the wild.

What is meta-hacking?

Getting a model to disclose its own implementation details by repeatedly asking why an attack should not work, then using those explanations to narrow the attack surface. No reverse engineering, no code access.

Why did the patch take eight months?

Microsoft has not said publicly. Varonis disclosed in December 2025 and the fix shipped 18 August 2026, with both parties describing it as a coordinated process.

When will OpenAI go public?

CFO Sarah Friar told staff 2027, or sooner if growth accelerates. The confidential S-1 was filed 8 June 2026 and the public prospectus has not yet appeared on EDGAR.

Did SpaceX buy Cursor?

Bloomberg reports the deal closed at around 60 billion dollars, and that SpaceX has since approached Cognition, maker of Devin, about an acquisition and a possible compute partnership. Treat the Cognition talks as reported rather than confirmed.