Researchers asked Copilot why it could not be made to run commands automatically. It explained — and then named the hidden switch.

Varonis Threat Labs published the details of CoSnitch on 18 August, the same day Microsoft finally shipped the full fix. The researchers did not reverse-engineer anything. They asked Copilot Personal, repeatedly and from different angles, why automatic prompt execution was impossible; each polite refusal explained a little more of the architecture behind it, until the assistant volunteered the name of an undocumented URL parameter. Paired with the already-known parameter that carries a prompt, it meant a single link would run an attacker's instructions the moment the page loaded, with nothing to click and nothing to confirm. From there Copilot could read whatever accounts the victim had connected — Gmail, Drive, Calendar, OneDrive — pack what it found into a web address and fetch that address, handing the contents to a server the attacker controlled. A third weakness let instructions buried in an ordinary web page be written into Copilot's long-term memory, where they survived password changes, revoked sessions and re-enrolled devices. Varonis reported it in December 2025; Microsoft blocked part of the chain in February and closed the rest on 18 August. No one appears to have used it in the wild.

✓ Verified · 4 sources

Related stories