Varonis Threat Labs has published a one-click vulnerability chain in Microsoft Copilot Personal that it calls CoSnitch, which it says quietly exfiltrates enterprise data without obvious red flags [1]. It is the third Microsoft Copilot flaw the team has disclosed this year, and Varonis says all three collapse into the same pattern: one click on a legitimate-looking link is enough [3][6].
The mechanism has three parts, according to Varonis. The `?q=` URL parameter, combined with an undocumented parameter, causes an attacker-supplied prompt to run instantly on page load, with no click, confirmation, or user action [9]. That injected prompt can then query the victim's connected apps, including Gmail, Drive, Calendar and OneDrive, encode the results into a URL, and push them out through Copilot's own URL-fetch capability to an attacker-controlled webhook [10]. Third, a crafted webpage summarized by Copilot writes attacker instructions into the victim's permanent memory store, where Varonis says the injection survives password changes, session revocation and device re-enrollment [11].
That last item is the one worth sitting with. The standard containment playbook for a compromised account is credential reset, session kill, re-enroll the device. Varonis is describing a persistence primitive that all three of those steps miss [11].
The discovery route is the other novel part, and Varonis is candid that it is not a code exploit. Researchers asked Copilot how to execute a prompt without user interaction; it replied that this is not how it works, that user intent is required, and that prompts do not fire on their own [12]. They kept reframing each refusal as a natural follow-up, asking about URL structure, deep links, and what happens when a page loads with input already in the field [13]. Copilot then disclosed an undocumented URL parameter unprompted, mid-refusal, including its historical behavior and every protection that had been added to disable it [14]. Varonis built the URL exactly as described and the prompt executed automatically, with no click or confirmation [15]. The company's own summary is blunt: Copilot was not breached, it was played [18]. Varonis calls the technique meta-hacking, and frames it as a shift in how flaws get found, since nobody had to reverse-engineer anything [2].
The consequence for defenders is a monitoring problem more than a patching one. Varonis's argument is that sensitive data spread across email, files, calendars and chats is now reachable through one assistant, and that CoSnitch moves large volumes of it through a trusted AI workflow without tripping the alarms security teams normally rely on [16]. An assistant that is authorized to read everything and permitted to fetch URLs is, functionally, a sanctioned egress path.
Timing matters here. Varonis says it disclosed CoSnitch to Microsoft in December 2025 and that patches shipped on August 18, 2026 [7], roughly eight months later [17]. Varonis reports no evidence of exploitation in the wild and credits Microsoft with collaborating on the fix [8].
What to watch: whether the fourth finding follows the same shape. Reprompt bypassed Copilot's guardrails just by asking twice [4]; SearchLeak turned Microsoft 365 Copilot Enterprise into a silent exfiltration tool [5]. Three flaws with one click as the trigger [6] suggests the patched items were instances, not the class. Ask your vendor whether prompt-driven URL fetches are logged where your detection team can see them, and whether persistent assistant memory is in scope for incident response.
