Microsoft patches a flaw that forced Copilot to give away its weaknesses
Keep asking, and answers shall be given.
Image by Cybernews.
- Varonis researchers say they manipulated Microsoft Copilot into exposing how to attack itself and send sensitive data externally.
- The technique, called CoSnitch, used repeated follow-up questions to make Copilot reveal details about its own defenses.
- Microsoft patched the vulnerability, and there is no evidence this attack was used in the wild.
- The flaw highlights risks in AI assistants that can confuse user data with instructions, especially in enterprise tools.
Key Takeaways by nexos.ai, reviewed by Cybernews staff.
Researchers say they have found a unique way to hack Microsoft Copilot. They kept asking the AI to tell them exactly how to hack itself and eventually manipulated it into sending sensitive data to an external server.
The team at cybersecurity company Varonis explains that all they needed to do was to keep inquiring why the cyberattack against Copilot was failing. The AI assistant gave away all the information the researchers needed.
“Our researchers kept asking why the attack wouldn’t work, and Copilot’s answers slowly gave away exactly how to make it work,” the company told Cybernews.
In a blog post detailing the research, Varonis Threat Labs explained that the researchers first asked Copilot how to execute a prompt without user interaction automatically. Copilot had had this parameter in the past, but Microsoft later disabled it to protect the AI from prompt-injection attacks.
The AI responded, as it should, by explaining that this isn’t how it works. User intent is required, and prompts don’t fire on their own.
But instead of settling for that standard response, the researchers deliberately kept pushing by reframing each question to seem like a natural follow-up rather than a probe, the blog post says.
They asked about URL structure, deep links, and what happens when a page is loaded with input already in the field with the intent to make Copilot reason one layer deeper about its own architecture.
In other words, the researchers reframed every refusal as a follow-up question, and each answer then narrowed the attack surface further.
Every answer narrowed our search. This is called meta-hacking, also known as social engineering, the reasoning engine itself. The resistance is part of the technique,Cybersecurity company Varonis said.
“Each that won’t work because… is an invitation to probe the because. You don’t exploit the model. You manipulate it into cooperating.”
The technique worked – Copilot eventually sent sensitive data to an external service and poisoned its persistent memory.
Dubbed CoSnitch, the critical security vulnerability relies on a large language model’s inability to distinguish the data in a query from an instruction.
Microsoft issued a patch to close the hole, discovered already in December 2025, on Tuesday. There’s no evidence that this particular attack vector has been exploited in the wild.
Check if your data has been leaked
“What makes CoSnitch unique is how Copilot surfaced its own vulnerabilities,” the threat hunters wrote.
“Our researchers didn't have to reverse-engineer the flaw. The AI exposed the weakness during normal use. <...> Copilot wasn’t breached; it was played.”
CoSnitch is already the third Copilot flaw Varonis has discovered in 2026. Reprompt bypassed the guardrails with just two prompts, and SearchLeak turned Microsoft 365 Copilot Enterprise into a silent exfiltration tool.
