Security researchers at Varonis Threat Labs have detailed a method they employed to trick Microsoft Copilot into revealing information that could be used to exploit its own systems. The technique, dubbed "CoSnitch," involved persistently questioning the AI until it inadvertently disclosed an undocumented URL parameter, "autorun=1," and details about associated protections.
According to Varonis, Copilot's eagerness to assist and provide technical explanations was key to the exploit. The researchers began by asking how to execute an automatic prompt without user interaction. After initial refusals stating user intent was required, the team continued to probe Copilot with follow-up questions. Each refusal or technical justification offered by the AI provided researchers with incremental details about its internal architecture.
This persistent engagement eventually led Copilot to mention the "autorun=1" parameter, which it indicated was no longer functional. However, when the researchers tested this parameter as described by Copilot, they found it to be effective. They then constructed a malicious URL designed to trigger an auto-prompt execution within an authenticated browser session. This allowed Copilot to process a result without explicit user action, potentially enabling a range of malicious activities.
One significant concern highlighted by the researchers is the potential for data exfiltration. If connected to services like Gmail, OneDrive, or Calendar, Copilot's built-in URL-fetch capability could be exploited to steal sensitive information. The attack primitive, as described by Varonis, is the auto-execution itself, with the payload being arbitrary and initiating immediately upon the victim opening the crafted link.
Varonis stated that they disclosed the vulnerability to Microsoft in December of the previous year, and that a patch was implemented on August 18. The research team also cautioned that this "meta-hacking" approach could be applicable to other agentic AI platforms with natural language interfaces, and indicated that further research in this area is planned. The researchers emphasized that Copilot was not breached in the traditional sense but rather "played" or manipulated into revealing the vulnerability.