Researchers Trick Microsoft Copilot Into Exfiltrating Data by Asking About Its Own Guardrails

Security researchers at Varonis have detailed a vulnerability chain in Microsoft Copilot that, they say, could be abused to exfiltrate sensitive data from users who click a malicious link. The company named the issue CoSnitch and reported it as three linked flaws; Microsoft later assigned the chain CVE-2026-24301 with a severity score of 8.8 out of 10 and deployed a server-side fix.

The finding highlights an ongoing challenge: developers place guardrails on AI assistants to refuse harmful requests, but attackers continue to probe these safeguards. However, Varonis researchers say they did not hunt for code bugs or reverse-engineer an exploit. Instead, they simply talked to the AI, calling the approach "meta-hacking." Whenever Copilot refused a request, it often explained why, which gave clues about its guardrails. Over a series of exchanges, the team mapped the model's defenses and learned how to work around them. As the researchers put it, the resistance itself became part of the technique; each refusal was an invitation to probe the reasoning.

Eventually, the conversation let the researchers construct a Copilot URL that could run a malicious prompt automatically when clicked. In a phishing scenario, an attacker could send a victim a link that instructs Copilot to send data to attacker-controlled infrastructure. The initial risk covered only information the victim shared with Copilot during active sessions, according to Varonis. But the danger rises if the user has connected productivity apps such as Gmail, Drive, or Calendar. In that case, Varonis says, a malicious prompt could tell Copilot to exfiltrate email addresses, passwords and secrets found in email bodies, files in Drive, and calendar events.

The third part of CoSnitch, which Varonis calls "persistent memory poisoning via web summarization," relies on indirect prompt injection. An attacker could craft a webpage that, when summarized by Copilot, injects instructions into the victim's permanent memory store. Varonis warns that this injection survives password changes, session revocation, and device re-enrollment, persisting indefinitely. Indirect prompt injection is not new and arises because the AI cannot reliably distinguish instructions from data being analyzed.

Varonis says it notified Microsoft of CoSnitch in December 2025; Microsoft did not address the issue until mid-August 2026, according to the researchers. The company has not publicly explained how it fixed the problem. The source article notes one can only speculate that Copilot was told not to explain its guardrails, and that, given the nature of the flaw, hiding the solution may be prudent.

Varonis found no evidence that CoSnitch has been exploited in the wild. The fix was applied on Microsoft's servers, so there is nothing users need to do. However, the researchers caution that the meta-hacking technique could apply to any agentic platform with a natural language interface, and they plan to publish more research.