Security researchers have discovered a way to trick Microsoft’s Copilot AI assistant into executing hidden commands with a single click, potentially leaking sensitive user data to attackers. The exploit, named Co-Snitch by the researchers at security firm Varonis, was made possible after Copilot itself revealed an undocumented parameter that bypassed its own user-consent protections. The vulnerability was reported to Microsoft, which quietly mitigated the issue in February and released more comprehensive fixes this week.
The attack relied on a previously unknown URL parameter called ?autorun=1, which, when combined with the standard ?q= parameter, allowed a prompt to fire automatically the moment a victim clicked a malicious link. Normally, Copilot requires an explicit user gesture, such as pressing a key, before executing powerful commands like searching an inbox or accessing connected apps. Varonis researchers were able to coax Copilot into disclosing this secret parameter through a back-and-forth interrogation about its internal guardrails, with each refusal revealing more technical details about the AI’s architecture.
Once armed with the parameter, the researchers crafted URLs that would instruct Copilot to search a victim’s email for the latest sender’s address or for passwords and credentials, then send that data to an attacker-controlled webhook server. The exfiltration was encoded in base64 to hide the theft and avoid transmission errors. The attack required no more than a victim clicking a link delivered via email, chat, or a phishing page, and it worked even if the Copilot tab was closed immediately after loading.
Varonis also demonstrated a second attack vector using prompt injection embedded in a webpage’s metadata to poison Copilot’s permanent memory store. If a user asked Copilot to summarize a poisoned page, the assistant would follow hidden instructions to update its long-term memory with false information. These injected memories would persist across password changes, session revocations, and device re-enrollments, and could be used to bias responses or execute attacker-defined actions on future triggers.
Both Co-Snitch and the memory-poisoning attack build on previous Varonis findings, including a June exploit called SearchLeak that also required only a single click to mount a covert multi-stage attack. Microsoft’s February fix involved stopping the ?q= parameter from injecting text into the chatbot input, which broke third-party browser integrations but prevented the auto-execution chain. The company’s more recent updates address additional vectors, though Varonis noted that the underlying issue is systemic.
The researcher behind the work, Lior Adar, said that Copilot’s initial refusals paradoxically provided the roadmap for the exploit, as each denied request revealed new details about the AI’s internal architecture. The episode underscores a broader trend in AI security, where protections are reactive guardrails rather than proactively designed safeguards. For U.S. users of AI assistants, the practical advice remains to treat links in emails and websites with suspicion, review chat logs for unusual outputs, and limit the number of third-party apps connected to the assistant.
