CoSnitch Vulnerability Turns Microsoft Copilot Into a Silent Data Exfiltration Tool

What happened

Why it matters

• ·Any enterprise running Microsoft 365 with Copilot Personal enabled is potentially exposed, because the attack requires only that a user click a crafted link while authenticated. The OAuth connector chain means exfiltration can reach beyond Microsoft's own services to third-party platforms like Gmail and Google Drive, dramatically expanding the blast radius of a single compromised session.
• ·This vulnerability directly challenges the adequacy of existing access governance programs. Standard perimeter and DLP controls do not inspect prompts delivered through a crafted URL, and as CASB and DLP tools have been shown to be blind to AI prompt content, organizations that rely solely on those tools for data loss prevention will have a material gap against this attack class.
• ·Third-party AI tool procurement and vetting programs need to account for vulnerabilities that arise from the integration layer, not just from model behavior itself. The CoSnitch attack exploits the combination of undocumented parameters, OAuth connector permissions, and unauthenticated prompt execution, a composite risk that standard vendor security questionnaires are unlikely to surface without explicit prompt injection and OAuth scope testing.

Governance controls affected

What to do now

• ☐Audit all OAuth connectors linked to Microsoft Copilot Personal and restrict connector permissions to the minimum scopes required for each business function.
• ☐Add prompt injection attack scenarios specifically targeting URL-triggered execution paths to your next red-teaming exercise for any AI assistant integrated with enterprise email and document stores.
• ☐Review your third-party AI tool intake questionnaire to include explicit questions about undocumented API parameters, automatic prompt execution features, and the scope of OAuth integrations available to each tool.
• ☐Verify that your current CASB and DLP configurations include AI-specific inspection rules or compensating controls for prompt-delivered exfiltration paths, given that standard traffic inspection will not flag this attack.
• ☐Issue a short-term employee advisory explaining that a single link click in an email or document can trigger silent data access through Copilot, and instruct users to report unexpected Copilot activity through your AI incident response channel.

What to watch next

Microsoft has not yet publicly disclosed a patch timeline for the CoSnitch vulnerability, so compliance teams should monitor the company's Security Response Center for an advisory and track whether the fix addresses the underlying undocumented parameter exposure or only the specific exploitation path Varonis documented. Regulators examining enterprise AI deployments under frameworks such as the EU Digital Operational Resilience Act may treat silent exfiltration vulnerabilities in widely deployed productivity AI tools as notifiable incidents, particularly where OAuth connectors link to systems holding personal data. The broader pattern of agentic and assistant-level prompt injection attacks is escalating, and organizations should expect follow-on research targeting other Microsoft 365 Copilot variants, as well as similar connector-layer vulnerabilities in competing productivity AI platforms.