{"id":9180,"date":"2026-08-19T02:27:16","date_gmt":"2026-08-19T02:27:16","guid":{"rendered":"https:\/\/cybersecurityinfocus.com\/?p=9180"},"modified":"2026-08-19T02:27:16","modified_gmt":"2026-08-19T02:27:16","slug":"microsoft-finally-patches-critical-one-click-copilot-vulnerability-almost-eight-months-after-learning-of-it","status":"publish","type":"post","link":"https:\/\/cybersecurityinfocus.com\/?p=9180","title":{"rendered":"Microsoft finally patches critical one-click Copilot vulnerability, almost eight months after learning of it"},"content":{"rendered":"
\n
\n
\n
\n
<\/div>\n

Almost eight months after confirming a critical security vulnerability within the personal version of its AI assistant, Copilot, Microsoft on Tuesday issued a patch to close the hole, which relies on an LLM\u2019s inability to distinguish the data in a query from an instruction.<\/p>\n

The CoSnitch hole was discovered by Varonis, and marked the third Copilot bug that Varonis has reported to Microsoft this year, following Reprompt<\/a>, which bypassed Copilot guardrails by repeating queries, and SearchLeak<\/a>, which Varonis said turned Microsoft 365 Copilot Enterprise into \u201ca silent exfiltration tool. All three share the same exploit pattern: one click on a legitimate-looking link is enough.\u201d<\/p>\n

A detailed blog<\/a>, posted by Varonis on Tuesday, said the hole\u2019s capabilities were significant.\u00a0<\/p>\n

CoSnitch relied on an attacker leveraging three different Copilot flaws, Varonis wrote:\u00a0<\/p>\n

Automatic prompt execution<\/strong>. \u201cThe ?q= URL parameter, combined with an undocumented parameter, causes any attacker-supplied prompt to execute instantly on page load: no click, no confirmation, no user action. One link is all it takes.\u201d<\/p>\n

Data exfiltration to external servers<\/strong>. \u201cAn injected prompt can query the victim\u2019s connected apps, such as Gmail, Drive, Calendar or OneDrive, encode the results into a URL and exfiltrate them via Copilot\u2019s built-in URL-fetch capability to an attacker-controlled webhook.\u201d<\/p>\n

Persistent memory poisoning<\/strong> via web summarization. \u201cA crafted webpage, when summarized by Copilot, injects attacker instructions into the victim\u2019s permanent memory store. The injection survives password changes, session revocation, and device re-enrollment, persisting forever.\u201d<\/p>\n

But the potentially most intriguing element of the CoSnitch bug was how it was discovered: Copilot essentially revealed the hole itself.\u00a0<\/p>\n

Copilot revealed its own flaw<\/h2>\n

\u201cWe prompted Copilot to explain why auto-execution was impossible, and each refusal came with a technical justification, which mapped the architecture,\u201d the Varonis post said. Varonis then \u201creframed every refusal as a follow-up question, and each answer narrowed the attack surface further. Copilot then disclosed an undocumented URL parameter, unprompted, mid-refusal, including its historical behavior and every protection put in place to disable it. We built the URL exactly as described. With no click or confirmation from the user, the prompt was successfully executed automatically. Copilot wasn\u2019t breached; it was played.\u201d<\/p>\n

Microsoft confirmed both the flaw and the fix, emailing a statement that said, \u201cour customers are already protected and do not need to take any action. We continuously update our guardrails to strengthen our protections against similar techniques.\u201d It also issued an MSRC disclosure<\/a> labeling the hole \u201ccritical.\u201d\u00a0<\/p>\n

But Microsoft\u2019s emailed comments also included a statement that is not strictly accurate: It said, \u201centerprise customers using Microsoft 365 Copilot are not affected.\u201d<\/p>\n

But analysts and others stressed that the complex nature of enterprise environments would often also house some consumer-grade Copilots from the personal accounts of workforce members, meaning that the flaw in the personal version could have absolutely impacted the enterprise version.<\/p>\n

This is further complicated by the fact that Microsoft also said that it \u201cis in the process of moving toward a more unified Copilot experience,\u201d referred to as Copilot Fusion; details of the planned product merger<\/a> began to leak last month. That means that enterprise CISOs need to be concerned about flaws in the personal version of Copilot that may be carried over into the merged offering.<\/p>\n

The timing of Microsoft\u2019s fix was also fragmented. Varonis reported the CoSnitch hole on December 31, and the company patched one element of the hole, its auto-execution capability, on February 1, noted Lior Adar<\/a>, a Varonis senior security researcher, in an interview, but it didn\u2019t complete the fix until Tuesday.<\/p>\n

That February patch \u201clowered the other vulnerabilities significantly,\u201d Adar said. And, added his colleague, Chen Levy Ben Aroy<\/a>, the Varonis Cloud Security Research Team leader, \u201cLLMs are a whole new world of vulnerabilities.\u201d<\/p>\n

Mark Tauschek<\/a>, VP and distinguished analyst at Info-Tech Research Group, said that he found the Varonis methodology of tricking Copilot into revealing its own flaws powerful.<\/p>\n

Varonis used \u201ca very sophisticated combination of social engineering on an LLM, a variety of jailbreaks, and a prompt injection attack that is very concerning in its capability,\u201d he said. \u201cThe combination of hack vectors is what makes it more startling, as we\u2019ve seen all of those methods alone before, but I think all three working for one exploit is new, at least from a disclosure perspective.\u201d<\/p>\n

For CISOs, Tauschek said urgent action might be required.\u00a0<\/p>\n

\u201cMuch like in the old macro virus days in the late 90s and early 2000s, the only way to definitively stop it is to turn it off. Disable macros back then. Disable Copilot now,\u201d Tauschek said. \u201cThere are many mitigation steps that can reduce risk to negligible, but that\u2019s not zero. The point is, it\u2019s just the beginning.\u201d<\/p>\n

The money trail will make this fix difficult<\/h2>\n

Aman Mahapatra<\/a>, chief strategy officer for Tribeca Softtech, a New York City-based technology consulting firm, said there is a much more difficult issue involved in this case. He argued that the financial incentives for the major AI companies will make meaningfully fixing these kinds of holes almost impossible.\u00a0\u00a0<\/p>\n

He pointed out that every guardrail that would fully close this class of attack degrades the product, because the same capabilities being exploited are the features that Microsoft is marketing as Copilot\u2019s value. \u201cThe fix and the feature are in direct tension, which means these will not be cleanly patched so much as perpetually mitigated, and the eight-month window is what it looks like when a vendor is negotiating between its security obligation and its product roadmap on every single fix,\u201d Mahapatra said.<\/p>\n

\u201cThis is the pattern CISOs must internalize: in agentic systems, the malicious action and the legitimate action are the same action with different intent, which collapses the entire signature-and-anomaly detection model that enterprise security has been built on for twenty years,\u201d Mahapatra said. \u201cCoSnitch is serious, but its defining property is that nothing was broken. Three chained flaws: an autorun URL parameter firing a prompt with no click, OAuth connector abuse reading full Gmail bodies rather than metadata, and persistent memory poisoning through web summarization, and every one is Copilot doing exactly what it was designed to do.\u201d<\/p>\n

Mahapatra added that the third element of the CoSnitch flaw is the most troubling.<\/p>\n

\u201cThe memory-poisoning component is the one being undersold, and it is the most dangerous. A single summarized webpage writes attacker instructions into Copilot\u2019s persistent memory, and that memory survives password changes, session revocation, and device re-enrollment,\u201d he said. \u201cEvery standard incident response step leaves the injection intact. The attacker needs no persistent infrastructure after the initial write, because every future session runs under attacker-controlled context, recorded only in a memory settings UI almost no user has opened.\u201d<\/p>\n

Flavio Villanustre<\/a>, CISO for the LexisNexis Risk Solutions Group, also pointed to a bigger-picture issue that impacts all agentic and genAI deployments.\u00a0<\/p>\n

\u201cThe mechanisms behind the prompt injection part of the attack are based on the inability of the LLM to differentiate between data, the unsafe data stream coming from an external web page, and instructions which happen to be embedded in that data stream by the attacker controlling that external web page,\u201d Villanustre said. \u201cThis is another example of why a different architectural approach to LLMs that separates data and instructions is needed<\/a> to better guarantee the safety of their operation. This is not something that Microsoft or any other AI vendor has addressed to date.\u201d<\/p>\n

This article originally appeared on Computerworld<\/a>.<\/em><\/p>\n

\n<\/p><\/div>\n<\/div>\n<\/div>\n<\/div>","protected":false},"excerpt":{"rendered":"

Almost eight months after confirming a critical security vulnerability within the personal version of its AI assistant, Copilot, Microsoft on Tuesday issued a patch to close the hole, which relies on an LLM\u2019s inability to distinguish the data in a query from an instruction. The CoSnitch hole was discovered by Varonis, and marked the third […]<\/p>\n","protected":false},"author":0,"featured_media":9181,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[],"class_list":["post-9180","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-education"],"_links":{"self":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/9180"}],"collection":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=9180"}],"version-history":[{"count":0,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/9180\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/media\/9181"}],"wp:attachment":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=9180"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=9180"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=9180"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}