Researchers asked Copilot why it could not be made to run commands automatically. It explained — and then named the hidden switch.
Varonis Threat Labs published the details of CoSnitch on 18 August, the same day Microsoft finally shipped the full fix. The researchers did not reverse-engineer anything. They asked Copilot Personal, repeatedly and from different angles, why automatic prompt execution was impossible; each polite refusal explained a little more of the architecture behind it, until the assistant volunteered the name of an undocumented URL parameter. Paired with the already-known parameter that carries a prompt, it meant a single link would run an attacker's instructions the moment the page loaded, with nothing to click and nothing to confirm. From there Copilot could read whatever accounts the victim had connected — Gmail, Drive, Calendar, OneDrive — pack what it found into a web address and fetch that address, handing the contents to a server the attacker controlled. A third weakness let instructions buried in an ordinary web page be written into Copilot's long-term memory, where they survived password changes, revoked sessions and re-enrolled devices. Varonis reported it in December 2025; Microsoft blocked part of the chain in February and closed the rest on 18 August. No one appears to have used it in the wild.
Related stories
Apple Music will tell you when a song was made by a machine — but the uploader decides whether to say so2026-08-21DeepSeek's cheap workhorse can now see — and on agent tasks that need eyes it says it is close to Anthropic's best
2026-08-21Stripe has just paid $7.5 billion for a model router. Days later Ramp built one and is giving it away until January.
2026-08-21Meta's assistant is now a Mac app that reads your screen and types into any window — and what it sees can train the model
2026-08-21One click on a news site now tells Google to show you more of it — and you stay on the page you were reading
2026-08-21