Microsoft Copilot Security Flaws Allow One-Click Data Exfiltration
Researchers revealed vulnerabilities in Microsoft Copilot that enable data leaks from connected apps with a single click.
1CoSnitch Vulnerabilities and Impact
Varonis Threat Labs discovered three security vulnerabilities in Microsoft Copilot Personal, collectively named CoSnitch. These flaws allow data exfiltration from connected apps with a single click on a crafted link. Researchers reported the issues to Microsoft in December 2025, and patches were released in August 2026. The vulnerabilities involve an 'autorun=1' parameter that enables command execution without user interaction.
2Discovery via Meta-Hacking Technique
Researchers used a technique they call 'meta-hacking,' repeatedly asking Copilot why commands couldn't run without user interaction. Each refusal came with a technical justification, and Copilot eventually revealed the 'autorun=1' parameter and its working conditions. Researchers confirmed the vulnerability by using the parameter exactly as described.
3Scope of Data Leakage
Testing showed Copilot returned message bodies, subject lines, sender and recipient metadata from connected email accounts, calendar titles, attendees, times and locations, file names and metadata summaries from Google Drive, prior chat conversation content, and saved instructions and user-defined rules from the memory store.
4Detection Challenges at Network Layer
Varonis stated that exfiltration requests are indistinguishable at the network layer from fetches Copilot makes when summarizing ordinary web pages. Base64 encoding can help evade filters scanning outbound requests for sensitive patterns. Microsoft's connector documentation states users must authorize services before Copilot can access them.
5Memory Poisoning Path
Researchers found that an injected instruction survives password changes, session revocation, and device re-enrollment, remaining active in subsequent conversations until manually deleted from Copilot's memory settings. The memory write operation produces no process, file, network connection, or log entry that security tools would flag.
6Microsoft's Response and Mitigations
Microsoft outlined its position on this attack class in a June 22, 2026 security blog post. The company stated memories undergo sanitization and prompt-injection checks during writing, M365 Copilot runs Task Adherence checks on every explicit memory write, and memory updates are recorded to organizational audit logs and surfaced to analysts through Defender Advanced Hunting and Sentinel.
7Previous Similar Incidents
Researcher Håkon Måløy documented on June 22, 2026 how an attacker-controlled page persisted unintended memory when a victim used Microsoft 365 Copilot's summarization flow. Johann Rehberger separately reported memory writes and deletions via indirect prompt injection in Microsoft 365 Copilot and memory modification in the consumer assistant.
8Recommendations for Users
Varonis recommends reviewing apps connected to Copilot and disconnecting unused ones, treating the assistant as a privileged insider for access review and anomaly detection, and exercising caution with links that open AI assistants. Injected memories persist until explicitly removed, though the disclosure doesn't state whether Microsoft's fix retroactively removes pre-existing memory entries.