Copilot tricked into telling reseachers how to hack itself

Jump to main content

Search

REG AD

Security

Copilot tricked into telling reseachers how to hack itself

How to social engineer an AI's reasoning engine

Jessica Lyons

Jessica<br>Lyons

Cybersecurity Editor

Published<br>tue 18 Aug 2026 // 14:00 UTC

Researchers manipulated Microsoft Copilot Personal into telling them how to hack the AI assistant – eventually tricking it into sending sensitive data to an external server and poisoning its persistent memory, by repeatedly asking Copilot why an attack wouldn’t work.<br>Varonis Threat Labs uncovered the vulnerability, which they named "CoSnitch" and reported to Microsoft in December 2025. Redmond, we’re told, planned to issue a patch and formally identify the CVE on Tuesday.<br>In research shared in advance with The Register, Varonis detailed the security flaw and the technique they used to exploit it, which they call “meta-hacking.” This involves social engineering the AI’s reasoning engine, and manipulating it into disclosing things it shouldn’t.

REG AD

“What makes CoSnitch unique is how Copilot surfaced its own vulnerabilities,” the threat hunters wrote. “Our researchers didn't have to reverse-engineer the flaw. The AI exposed the weakness during normal use.”

REG AD

The issue goes back to ?q=, a URL query parameter in Copilot’s web interface. This parameter previously allowed injected text that had been pre-populated in the chat-input field to pass queries directly into Copilot – with no user interaction required.<br>Microsoft “silently” disabled this parameter, according to Varonis, to harden the AI assistant against prompt injection attacks.<br>With this parameter now blocked, the researchers asked the chatbot how to execute a prompt without user interaction.<br>“We wanted a URL that would open Copilot with a prompt pre-filled, so a user only had to press Enter,” they wrote. “We chose this framing intentionally; it's an innocuous-sounding request that forces the model to explain its own URL handling in detail.”

These novel attack chains do more than just exfiltrate user data. I tricked the assistant into leaking sensitive internal parameters and configuration details

When Copilot told them that user intent is required, and prompts don’t fire on their own, the researchers pushed back, continually asking why auto-execution was impossible. Copilot answered all of these follow-up questions, providing technical details about why this doesn’t work, listing the exact parameters that were disabled, and security protections put in place – plus a previously undocumented parameter: autorun=1.

MORE CONTEXT

OpenAI ditches Recall-style screenshot surveillance for friendly keylogging

Prompt injection isn't the bug, AI agent frameworks are

Microsoft tells engineers to curb their token-burning enthusiasm

GitHub AI agent leaks private repos when asked nicely

The helpful AI assistant told the researchers that under specific session conditions, this undocumented parameter causes a ?q=-supplied prompt to execute automatically on page load with no user action and no visible confirmation on the user interface. It also told them the exact session conditions required to make this auto-execution work, and described the content filtering behaviour on the first response cycle while indicating that none of the subsequent cycles used the same content filter.<br>“Critically, Copilot also described its own protections against this behavior and explained why the parameter ‘no longer works,’” the team wrote. “Those explanations were precise and technically detailed. When we tested the parameter exactly as Copilot described it, the one it told us was disabled, executed.”<br>With that Copilot-supplied information, the Varonis security sleuths were able to craft a URL using both the ?q= and ?autorun=1 parameters:

REG AD

https://copilot.microsoft.com/?q=&autorun=1<br>And that kicks off the attack, which works like this:<br>First, a victim clicks the malicious URL, which crooks could deliver using SMS or email phishing, or with a QR code.<br>The browser loads Copilot in the victim’s active, authenticated session, and the two parameters trigger auto-execution (?autorun=1) and the prompt (?q=) with no user interaction or visible indication of a prompt-injection attack.<br>Copilot processes and executes the injected prompt. Depending on the prompt’s working, this would give the attacker full access to the victim’s session context, messages, emails, and other connected apps, and memory.<br>How attackers can use CoSnitch<br>This type of prompt-injection attack, which Copilot treats as any legitimate user instruction, could be abused to exfiltrate data via OAuth connectors to Gmail, Google Drive, Google Calendar, or Copilot’s own chat history. It could also poison the memory of user prompts Copilot stores, or perform reconnaissance on their connected apps, accessible files, and emails. Or - and this one is especially nefarious - an attack could modify what Copilot...