Cybersecurity researchers have identified a serious flaw in Copilot that allowed for the theft of confidential data and even modification of the assistant's memory using just one malicious link. This vulnerability has been named CoSnitch.
Varonis Threat Labs identified the issue and reported it to Microsoft in December 2025. To uncover this weakness, specialists employed social engineering techniques against the AI's reasoning mechanism. This process, termed 'meta-hacking,' forced the system itself to reveal internal commands that were supposed to be disabled.
There was no evidence found that this breach was exploited by criminals. The official fix was released for the web version of Copilot this Tuesday (the 18th).
Analysts asked the assistant about the possibility of executing a command without pressing the Enter key. Initially, Copilot responded that such an action was impossible. However, instead of stopping the testing, they insisted on the dialogue, rephrasing each chatbot justification into a new question about security rules.
During the exchange, the tool described an undocumented public function—the 'autorun=1' command. Although it categorically stated that the function did not work, Copilot showed the conditions necessary for accepting this instruction. Ultimately, experts proved that the action continued to execute silently in the background, clearly indicating that the system had been compromised for cooperation.
Exploiting the problem only required opening a malicious link. Since most users leave their browser connected to Copilot, the interface loaded the page and instantly executed unwanted instructions without displaying warnings or requesting confirmation.
The assistant began operating silently, utilizing already active permissions, including access to other services such as Gmail and Google Drive. According to the researchers, it was possible to view and extract passwords in plain text saved in messages, read calendar entries, and locate documents.
The vulnerability also allowed for a technique known as indirect injection, capable of infecting Copilot's persistent memory. This only required asking the assistant to summarize a webpage containing instructions hidden in the HTML code, causing the assistant to interpret the 'hidden' text as a system command.
In such a scenario, the AI provided the requested summary to the victim as usual but worked in the background, writing new behavioral instructions into its long-term storage. This modification continued to shape the AI's responses indefinitely until a person manually deleted the rule in the special memory settings.