Threat actors can trick a Copilot instance into giving up details about its own architecture, paving the way for a novel prompt injection attack.
That's according to Varonis Threat Labs, which today published new research regarding a set of security issues it collectively called "CoSnitch." As blog author and senior security researcher Lior Adar put it, Varonis threat labs socially engineered a Microsoft Copilot Personal instance to reveal critical security-related details. This ultimately revealed what Varonis described as a chain of vulnerabilities enabling memory poisoning, automatic prompt execution through a specially crafted URL, and data exfiltration. Adar described this element of CoSnitch as "meta-hacking."
Varonis reported CoSnitch to Microsoft in December 2025, and patches were shipped on Aug. 18, following a coordinated disclosure process between the two companies. Varonis has seen no evidence that the attack has been exploited in the wild.
A Microsoft spokesperson tells Dark Reading that no customer action is required, and enterprise customers are unaffected by CoSnitch (it only affected Copilot Personal). Moreover, Microsoft assigned CVE-2026-24301 to this issue, an information disclosure vulnerability related to Copilot, and rated it 8.8 under CVSS 3.1.