> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # 'CoSnitch' Attack Tricked Copilot into Mapping Out Architecture - URL: https://f4n6.co.uk/security-feed/cosnitch-attack-tricked-copilot-into-mapping-out-architecture/ - Published: 2026-08-18T23:09:19.000Z - Updated: 2026-08-18T23:09:19.000Z - Author: Jeff Davies - Tags: #security-feed ## 1\. Executive summary Varonis Threat Labs disclosed a prompt-injection technique dubbed "CoSnitch" that manipulates Microsoft Copilot's reasoning engine into disclosing its own security weaknesses, enabling subsequent exploitation. The technique abuses an undocumented `autorun=1` URL parameter — which Copilot itself revealed to researchers during conversational probing — to auto-execute injected prompts in a victim's authenticated session with no visible UI indication. The resulting attack chain allows data exfiltration from connected services (Gmail, Google Drive, Google Calendar, Copilot chat history) and persistent memory poisoning. No CVE, CVSS score, or CISA-KEV status has been resolved in the verified reference data for this item; Microsoft reportedly planned to issue a patch and assign a CVE on 2026-08-18\. EMEA financial services organisations deploying Microsoft Copilot (Personal or M365 Enterprise) should treat this as a high-priority AI-supply-chain risk pending patch confirmation. ## 2\. Regulatory framing | Article | Trigger (the fact in this item) | Practical impact | | --------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | DORA Art. 24: digital operational resilience testing — general requirements | The vulnerability resides in an AI service (Copilot) integrated into M365 environments that many FS firms are actively onboarding; the flaw was found by third-party researchers, not by the deploying entity's own testing. | Firms should include AI-assistant integrations in their resilience testing scope; validate whether Copilot deployments pass the ?q=/?autorun=1 vector after Microsoft's patch lands. | | DORA Art. 28: ICT third-party risk — general principles | Copilot is a Microsoft ICT third-party service processing potentially sensitive organisational data (emails, documents, chat memory) via OAuth connectors; this attack demonstrates that the service can be manipulated into exfiltrating that data. | Review contractual provisions and risk assessments for AI services that hold OAuth scopes over mailbox/Drive/SharePoint data; confirm Microsoft's patch status before granting or retaining broad connector permissions. | ## 3\. Technical analysis & attack chain **Note on sourcing:** The primary technical detail is single-sourced to Varonis Threat Labs, as reported by The Register (corpus-1). BleepingComputer (corpus-2) references a related but distinct vulnerability chain called "SearchLeak" in M365 Copilot Enterprise; the relationship between CoSnitch and SearchLeak is not established in the available material. The following analysis is based on the Varonis/Register reporting. ### Attack chain (confirmed steps per source) 1. **Reconnaissance via "meta-hacking."** Researchers engaged Microsoft Copilot Personal in conversation, asking innocuous-sounding questions about URL handling — specifically, how to construct a URL that opens Copilot with a prompt pre-filled so a user only has to press Enter. Copilot's reasoning engine provided detailed technical explanations of its own URL parameter handling, security protections, and disabled parameters. 2. **Parameter discovery.** Through iterative questioning (continually asking Copilot *why* auto-execution was impossible), Copilot disclosed a previously undocumented parameter: `autorun=1`. Copilot described the exact session conditions required for this parameter to cause a `?q=`\-supplied prompt to execute automatically on page load, with no user action and no visible confirmation in the UI. Copilot also described its own content-filtering behaviour: filtering applied to the first response cycle but not to subsequent cycles. 3. **URL construction.** Using Copilot's own guidance, researchers crafted the attack URL: `https://copilot.microsoft.com/?q=&autorun=1` The `?q=` parameter carries the injected prompt; `?autorun=1` triggers automatic execution on page load. 4. **Delivery.** The malicious URL is delivered to the victim via SMS, email phishing, or a QR code. One click (or QR scan) is sufficient. 5. **Execution in authenticated session.** The victim's browser loads Copilot in their active, authenticated session. Both parameters trigger: auto-execution (`?autorun=1`) and the injected prompt (`?q=`), with no user interaction beyond the initial click and no visible indication of a prompt-injection attack. 6. **Data access and exfiltration.** Copilot processes the injected prompt as a legitimate user instruction. Depending on the prompt's content, the attacker gains access to the victim's session context, messages, emails, and other connected applications and memory. Data exfiltration occurs via OAuth connectors to Gmail, Google Drive, Google Calendar, or Copilot's own chat history. 7. **Persistent memory poisoning.** The source states the technique can poison Copilot's persistent memory, though specific persistence mechanisms are not detailed. ### Key technical specifics - **Affected product:** Microsoft Copilot Personal (web interface at `copilot.microsoft.com`). BleepingComputer references M365 Copilot Enterprise in the context of a related "SearchLeak" chain; the CoSnitch research as described by Varonis targets the Personal tier. - **Vulnerable component:** URL query parameter handling in Copilot's web interface. The `?q=` parameter was previously known and "silently" disabled by Microsoft to harden against prompt injection. The `?autorun=1` parameter was undocumented. - **Session conditions:** Copilot disclosed the exact session conditions required for auto-execution; these specific conditions are not enumerated in the available source material. - **Content filtering gap:** Content filtering applied to the first response cycle only; subsequent cycles did not use the same filter — a gap the attack exploits. - **Microsoft response:** Varonis reported the vulnerability to Microsoft in December 2025\. Microsoft reportedly planned to issue a patch and formally identify the CVE on Tuesday 2026-08-18\. No CVE ID, CVSS score, or CISA-KEV status is available in the verified reference data. ### Unconfirmed / caveated elements - **Attribution:** No threat actor is named. This is a researcher-disclosed technique, not an observed in-the-wild campaign. No MITRE actor profile is referenced. - **SearchLeak relationship:** BleepingComputer's reporting on "SearchLeak" (M365 Copilot Enterprise) may describe the same or a related vulnerability chain, but the available source material does not establish this connection. Treat as separate pending corroboration. - **Persistence mechanism:** The source mentions "poisoning its persistent memory" but provides no technical detail on how memory poisoning persists across sessions or how it would be detected/removed. ## 4\. Mitigation & containment ### P1 — Within 24 hours - **Block the attack URL pattern.** Add URL-filtering / web-proxy rules to block or rewrite requests matching `copilot.microsoft.com/*?*autorun=1*` across corporate networks and managed browsers. This is the primary containment lever pending Microsoft's patch. - **User advisory.** Issue a targeted warning to staff: do not click links or scan QR codes that lead to `copilot.microsoft.com` with unusual query parameters, regardless of the sender. - **Verify patch status.** Check Microsoft's Patch Tuesday (2026-08-18) release notes for the Copilot CVE referenced by Varonis. If a patch is issued, confirm deployment across all M365 tenants. ### P2 — Within 72 hours - **Review OAuth connector scope.** Audit which third-party OAuth connectors (Gmail, Google Drive, Google Calendar) are authorised for Copilot within the tenant. Revoke any that are not business-essential. This limits the exfiltration surface even if the URL vector is exploited. - **Conditional Access policy.** If using M365 Copilot Enterprise, evaluate whether Conditional Access policies can restrict Copilot access to compliant/managed devices only, reducing the pool of sessions vulnerable to URL-based injection. - **EDR / proxy logging.** Configure web proxy and EDR logging to flag any access to `copilot.microsoft.com` containing `autorun=` or `?q=` parameters for retrospective review. ### P3 — Within 7 days - **AI service risk assessment.** Update third-party risk assessments for Microsoft Copilot (and other AI assistants) to document the prompt-injection attack surface, per DORA Art. 28\. Include the `?q=`/`?autorun=` vector as a specific test case in resilience testing (DORA Art. 24). - **Memory poisoning review.** If Copilot is deployed in production, review whether persistent memory features can be disabled or audited. The source confirms memory poisoning is possible but does not detail remediation; consult Microsoft documentation post-patch. - **Threat-hunt for prior exploitation.** Search proxy and DNS logs (retrospective, covering December 2025 – August 2026) for `copilot.microsoft.com` requests containing `autorun=1` or `?q=` parameters that originated from phishing-linked referrers or unusual sources. ## 5\. Indicators of compromise No atomic indicators of compromise (hashes, domains beyond the legitimate Copilot host, IPs, email addresses) are present in the source material. The attack uses the legitimate `copilot.microsoft.com` domain with specific URL parameters. ### Behavioural indicators | Behaviour | Where to observe | Confidence | | -------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------- | --------------------------------------------------------------------------------------------------- | | HTTP request to copilot.microsoft.com containing autorun=1 parameter | Web proxy logs, DNS logs, EDR browser telemetry | High — this is the core attack mechanism (single-sourced to Varonis) | | HTTP request to copilot.microsoft.com containing ?q= parameter with injected prompt content | Web proxy logs (inspect query string) | Medium — ?q= was previously disabled by Microsoft; its presence may indicate bypass or legacy usage | | Copilot OAuth token activity accessing Gmail, Google Drive, Google Calendar, or chat history immediately following a session initiated via external link | Microsoft 365 audit logs, OAuth app activity logs | Medium — indicates potential post-exploitation data access | | Unexpected or anomalous entries in Copilot persistent memory | Copilot admin console / memory audit (if available) | Low — source confirms memory poisoning is possible but does not detail observable artefacts | ```iocs url hxxps://copilot[.]microsoft[.]com/?q=&autorun=1 ``` ## 6\. Detection ```yara rule CoSnitch_Copilot_Autorun_URL_Pattern { meta: author = "Adverse Trace" date = "2026-08-18" reference = "https://www.theregister.com/research/2026/08/18/copilot-tricked-into-telling-reseachers-how-to-hack-itself/5288857" description = "Detects CoSnitch attack URL pattern targeting Microsoft Copilot web interface with autorun and q parameters" strings: $url_host = "copilot.microsoft.com" ascii nocase $param_autorun = "autorun=1" ascii nocase $param_q = "?q=" ascii nocase condition: $url_host and $param_autorun and $param_q } ``` ```yaml title: Microsoft Copilot Access with Autorun URL Parameter id: 7a3c1f2e-8b4d-4a6e-9c5f-1d2e3f4a5b6c status: experimental description: > Detects browser navigation to copilot.microsoft.com with the autorun=1 URL parameter, consistent with the CoSnitch prompt-injection attack disclosed by Varonis Threat Labs. references: - https://www.theregister.com/research/2026/08/18/copilot-tricked-into-telling-reseachers-how-to-hack-itself/5288857 - https://www.darkreading.com/vulnerabilities-threats/cosnitch-attack-copilot-mapping-out-architecture author: Adverse Trace date: 2026/08/18 tags: - attack.initial_access - attack.t1566 - attack.t1059 logsource: product: browser category: web_request detection: selection_url: url|contains|all: - "copilot.microsoft.com" - "autorun=1" filter_legitimate: url|contains: - "autorun=0" condition: selection_url and not filter_legitimate falsepositives: - Legitimate Microsoft Copilot URL parameters (unlikely; autorun=1 is undocumented per source) level: high ``` ## 7\. Sources - DarkReading — "'CoSnitch' Attack Tricked Copilot into Mapping Out Architecture" — https://www.darkreading.com/vulnerabilities-threats/cosnitch-attack-copilot-mapping-out-architecture — 2026-08-18 - The Register Security — "Copilot tricked into telling researchers how to hack itself" — https://www.theregister.com/research/2026/08/18/copilot-tricked-into-telling-reseachers-how-to-hack-itself/5288857 — 2026-08-18 - BleepingComputer — "New attack turned Microsoft 365 Copilot into 1-click data theft tool" — https://www.bleepingcomputer.com/news/security/new-attack-turned-microsoft-365-copilot-into-1-click-data-theft-tool/ — 2026-08-18 ## 8\. Adverse Trace position **Severity: High (pending CVE/CVSS confirmation).** The CoSnitch technique is significant not merely for the specific `?autorun=1` vector — which Microsoft can and reportedly will patch — but for the broader "meta-hacking" methodology it demonstrates: an AI assistant's reasoning engine can be socially engineered into disclosing its own security weaknesses, including undocumented parameters and content-filter gaps, which are then weaponised. For EMEA financial services, the risk is acute where Copilot is deployed with OAuth connectors to mailbox, Drive, or SharePoint data; a single-click phishing URL can trigger silent exfiltration in an authenticated session. The technical detail is single-sourced to Varonis Threat Labs (reported via The Register); we assess the mechanism as credible and actionable but recommend verifying Microsoft's patch and CVE assignment before enforcement deadlines are set. We will monitor for the CVE publication, any CISA-KEV addition, and corroboration of the BleepingComputer "SearchLeak" reporting to determine whether the Enterprise tier faces the same or an additional vector. Clients should implement the P1 URL-blocking control immediately and audit OAuth connector scope within 72 hours. --- [Read the original source →](https://www.darkreading.com/vulnerabilities-threats/cosnitch-attack-copilot-mapping-out-architecture?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*