Researchers at security firm Varonis specifically questioned Microsoft 365 Copilot about its own safeguards, and the assistant ended up providing exactly the clues needed to exploit a critical security flaw. A manipulated link was then all it took to quietly steal passwords, emails, and calendar entries. Microsoft has since fixed the vulnerability.
Meta-hacking instead of classic reverse engineering
Varonis documents the attack, which it calls "CoSnitch," in detail on its own blog. Instead of analyzing the assistant through classic reverse engineering, the researchers questioned Copilot directly about its internal architecture. At first, the assistant refused to answer, but according to Varonis researcher Lior Adar, every refusal itself contained technical details about the internal workings. Through skillful follow-up questions, Copilot eventually revealed undocumented URL parameters and safeguards.
Armed with that knowledge, the researchers were able to bypass the safeguards and reconstruct a malicious URL. When a user clicks it, the browser loads their current authorized Copilot session, and the injected prompt executes automatically, with no confirmation or warning, and with access to every service connected to Copilot.
Data theft via Base64 and persistent manipulation
The assistant then pulled data from Gmail, Google Drive, and other connected apps. To exfiltrate it unnoticed, it encoded the stolen information in Base64 format, which turns arbitrary data into innocuous-looking strings, and sent it to an attacker-controlled server via an ordinary HTTP call. To security software, that looks like normal traffic.
Particularly problematic: hidden instructions on a webpage that Copilot was asked to summarize wrote themselves permanently into the assistant's memory. According to Varonis, these entries even survived password changes and logins on other devices. This form of indirect prompt injection is a structural problem affecting essentially all AI assistants that process external content. Attackers smuggle hidden instructions into content a model processes, such as webpages or documents, and the model treats those instructions as legitimate commands.
No action needed from customers
Microsoft says it fully fixed the vulnerability on August 18, 2026, after Varonis reported it back in December 2025 and a first, quiet partial fix followed in February. It's unclear how many users were actually affected, but the potential reach is considerable: according to Microsoft, 30 million paying customers now use Copilot. Users currently don't need to do anything, as Microsoft says its safeguards are continuously updated.
Varonis, which sells its own data security software for enterprise environments and thus has a commercial interest in such findings, nonetheless sees a fundamental problem: AI assistants are secured reactively rather than protected proactively. If you use Copilot or similar tools, you should keep the number of connected apps as low as possible and scrutinize links from unknown sources especially carefully.