Every Step of the Copilot Attack Was the Product Working Exactly as Designed

The chain, link by link

Varonis Threat Labs grouped the findings into three vulnerabilities. The first two form the one-click exfiltration path. The third is separate and, in the researchers' framing, worse.

1. Automatic prompt execution

Copilot's web interface has long accepted a query parameter that pre-populates the chat input. Pre-populating is harmless — the text sits there until a human presses send.

Varonis found an undocumented parameter that could be used alongside it to skip that step. The prompt fired on page load with no interaction at all. Worse, once execution began it ran to completion even if the victim closed the tab immediately.

2. OAuth connector abuse

With a prompt running inside the victim's authenticated session, the attacker inherits whatever Copilot can reach. In testing that meant Gmail, Google Drive, Google Calendar and Copilot's own memory — and crucially, full Gmail message bodies rather than metadata. Results were sent to an attacker-controlled server.

3. Persistent memory poisoning

Every incident-response playbook assumes a password reset and session revocation evicts an attacker. Against a poisoned memory store, both are theatre.

Meta-hacking: the model gave up its own architecture

Varonis did not reverse-engineer anything. Researchers repeatedly asked Copilot why automatic prompt execution ought to be impossible, then reframed each refusal as a follow-up question. Copilot explained its URL handling and the historical protections around it, and in doing so surfaced the undocumented parameter that made the chain work.

Sit with the failure mode. The model correctly refused to provide harmful instructions. It then described its own implementation in enough detail that harmful instructions were unnecessary. Refusal training governs what a model will say about attacking a system; it does not govern what a model will say about itself.

That generalises. Any assistant that explains its reasoning helpfully is a potential disclosure channel about its own architecture, and reasoning transparency is a feature every major vendor is currently adding.

Why detection missed all of it

The defining property of CoSnitch is that nothing broke. Each step is Copilot doing exactly what it was built to do: follow a URL parameter, use an OAuth connector, summarise a page, write to memory.

In agentic systems the malicious action and the legitimate action are frequently the same action with different intent. Twenty years of signature and anomaly detection assumes those look different at the wire level. Here they do not, and there is no anomaly to detect because the behaviour is nominal.

The pattern across three flaws

All three are Varonis findings from this year. All three need one click on a legitimate-looking link. This is not three unlucky bugs — it is one architectural pattern producing repeated results.

Memory has been flagged before, too. Håkon Måløy documented attacker-persisted memory through a Microsoft 365 summarisation flow, publishing 22 June 2026 after a 90-day coordination window with the Microsoft-side status recorded as mitigated globally. Johann Rehberger separately reported memory writes and deletions via indirect prompt injection in both the enterprise and consumer assistants.

The audit to run this week

This applies to any assistant with connectors, not just Copilot.

What this means for the wider category

The value of an AI assistant is proportional to what it can reach. Connect email, files, calendar and chat and it becomes genuinely useful — and simultaneously becomes a single conversational interface sitting in front of everything worth stealing.

That trade is not avoidable, and pretending otherwise is not useful advice. What is avoidable is connecting things you do not use, leaving memory unread for months, and assuming a password reset evicts an attacker. All three are free to fix.

FAQ

Was my data stolen?

Varonis found no evidence CoSnitch was exploited in the wild before the patch. If you used Copilot Personal with connected Google accounts before 18 August, reading your assistant memory is still worth ten minutes.

Does this affect Microsoft 365 Copilot at work?

Microsoft says enterprise customers were unaffected and CoSnitch touched Copilot Personal only. The earlier SearchLeak finding did involve the enterprise product.

How do I check for poisoned memory?

Open Copilot's memory interface and read the entries. There is no log, no file and no network artefact to look for — the memory view is the only place a poisoned entry appears.

Do password changes remove an injected memory?

No. Varonis reports the injection survives password changes, session revocation and device re-enrolment. It has to be deleted manually from memory.

Could this work against other assistants?

Varonis notes the technique may apply elsewhere. The underlying pattern — connectors plus persistent memory plus a model that explains its own behaviour — is not unique to Microsoft.

What is the single most useful thing to do today?

Open your assistant's connector list and remove everything you are not actively using. It takes two minutes and shrinks the blast radius of every future flaw in this class, not just this one.