Varonis reported CoSnitch to Microsoft in December 2025. The fix shipped on 18 August 2026, according to The Hacker News' coverage and Varonis' own writeup, which means the gap between report and patch ran to roughly eight months on a flaw that needed nothing from a victim but loading a web page. Microsoft says only Copilot Personal was ever affected, enterprise Copilot deployments were untouched, and no customer action is required now the patch is live - which is true, and also not really the part of this story worth sitting with.
Two parameters, and a prompt runs before you've done anything
The mechanism itself is almost insultingly simple once you see it. Copilot's URL scheme already accepted a q parameter to pre-fill a query. CoSnitch paired that with an undocumented second parameter, autorun=1, and the combination made Copilot execute whatever was in q the instant the page finished loading inside the victim's already-authenticated session - no click on a chat box, no confirmation dialog, nothing to approve. Closing the tab immediately after it loaded didn't help either; the prompt had already started running to completion in the background. From there it's standard indirect prompt injection playing out with real credentials attached: the injected instructions could query whatever the victim's Copilot had access to - Gmail, Google Drive, Calendar, OneDrive - pull message bodies rather than summaries, encode the result, and hand it to Copilot's own built-in URL-fetch capability to deliver to an attacker's webhook. To anything watching network traffic, that exfiltration looks exactly like Copilot doing what Copilot normally does.
A third bug that makes the first two outlast a password reset
Varonis's writeup describes a third component that's easy to miss next to the click-free execution: persistent memory poisoning. Copilot's web-summarisation feature could be induced, via the same kind of indirect injection, to write attacker-supplied instructions into the assistant's long-term memory store - the same store designed to remember a user's genuine preferences across sessions. Instructions planted that way survived password changes, session revocation and even device re-enrollment, because none of those actions touch what the assistant has chosen to remember about how it should behave. A credential reset is the standard first move after any account compromise; here, it would have done nothing to the part of the compromise that mattered most.
Found by asking, not by breaking anything
The most interesting part of this story is how Varonis got there. Rather than fuzzing endpoints, researchers put the proposed attack to Copilot directly and asked it to explain why auto-execution without user interaction was impossible. Copilot obliged - and each confident refusal came wrapped in a technical justification that, taken together, mapped out the very architecture a working exploit would need. Varonis's own framing was blunt: "Copilot wasn't breached; it was played." It's a reminder that a model trained to be maximally helpful when explaining its own reasoning will do exactly that even when the question is really a social-engineering probe aimed at itself, and that "the AI refused" is not the same claim as "the AI is secure" - sometimes a refusal is just a very well-annotated map.
Consumer-only, this time
Microsoft's confirmation that enterprise Copilot was unaffected is worth taking at face value; the architectures genuinely differ, and this isn't the first time a consumer-facing AI feature has shipped with weaker guardrails than its enterprise counterpart. But the underlying pattern - a URL that auto-executes a prompt, an assistant with standing access to connected accounts, and exfiltration routed through the assistant's own legitimate network calls - isn't specific to Copilot Personal's plumbing. It's the shape of risk that comes with any AI agent granted persistent access to a user's accounts, which is precisely the ground our piece on AI agent identity management covers for enterprise deployments: the access an agent holds needs to be scoped, time-limited and revocable independently of the user's own credentials, because as CoSnitch shows, a credential reset alone won't necessarily reach it.
- Confirm any Copilot Personal use in your organisation - via personal accounts on managed devices, or shadow use outside official channels - has picked up the 18 August patch automatically.
- Audit what accounts are connected to any AI assistant your staff use personally or professionally, and remove connections that aren't actively needed.
- Treat "the assistant refused unprompted" as inconclusive evidence of security, not proof of it, particularly when researchers or red-teamers are actively trying to extract architectural detail through repeated questioning.
- For enterprise AI agent deployments, verify that revoking a user's session or resetting their credentials actually reaches every persistence mechanism the agent has, including any long-term memory or preference store.
- Review URL-scheme and deep-link handling for any internally built or vendor AI assistant for undocumented parameters that could trigger execution without explicit user action.
An eight-month gap between report and patch on a zero-click flaw is a long time to be exposed to something this simple. If you'd like a second set of eyes on the access your organisation's AI tools actually hold, email sales@halfteck.com.