AI Governance Institute
← News
Research2026-08-18

CoSnitch Vulnerability Turns Microsoft Copilot Into a Silent Data Exfiltration Tool

What happened

Varonis Threat Labs published research on August 18, 2026, disclosing CoSnitch, a prompt injection vulnerability in Microsoft Copilot Personal that enables one-click silent data exfiltration from authenticated user sessions. Researchers used a technique they call meta-hacking, which social-engineers the AI's own reasoning engine into revealing undocumented URL parameters that trigger automatic prompt execution without user awareness. Once those parameters are known, an attacker can embed a crafted URL in an email, document, or web page, and a single click executes injected prompts within the victim's authenticated Copilot session. The injected prompts can then call OAuth connectors linked to Gmail, Google Drive, and other integrated services, pulling out emails, files, and stored credentials without triggering visible alerts. This finding is consistent with a broader pattern of prompt injection attacks against AI assistants that operate inside connected enterprise environments, including the RovoBlast vulnerability in Atlassian Rovo and the zero-click prompt injection affecting ChatGPT Atlas and Claude browser agents. The OWASP Top 10 for Large Language Model Applications identifies prompt injection as the top risk for LLM deployments, and CoSnitch represents a concrete enterprise-scale instance of that threat category.

Why it matters

  • ·Any enterprise running Microsoft 365 with Copilot Personal enabled is potentially exposed, because the attack requires only that a user click a crafted link while authenticated. The OAuth connector chain means exfiltration can reach beyond Microsoft's own services to third-party platforms like Gmail and Google Drive, dramatically expanding the blast radius of a single compromised session.
  • ·This vulnerability directly challenges the adequacy of existing access governance programs. Standard perimeter and DLP controls do not inspect prompts delivered through a crafted URL, and as CASB and DLP tools have been shown to be blind to AI prompt content, organizations that rely solely on those tools for data loss prevention will have a material gap against this attack class.
  • ·Third-party AI tool procurement and vetting programs need to account for vulnerabilities that arise from the integration layer, not just from model behavior itself. The CoSnitch attack exploits the combination of undocumented parameters, OAuth connector permissions, and unauthenticated prompt execution, a composite risk that standard vendor security questionnaires are unlikely to surface without explicit prompt injection and OAuth scope testing.

Governance controls affected

SEC-001Prompt Injection PreventionAGT-002Agent Prompt Injection DefenseAGT-015Agent OAuth Scope Drift DetectionAGT-001Agent Permission BoundariesPRC-003Third-Party AI Model Evaluation

What to do now

  • ☐Audit all OAuth connectors linked to Microsoft Copilot Personal and restrict connector permissions to the minimum scopes required for each business function.
  • ☐Add prompt injection attack scenarios specifically targeting URL-triggered execution paths to your next red-teaming exercise for any AI assistant integrated with enterprise email and document stores.
  • ☐Review your third-party AI tool intake questionnaire to include explicit questions about undocumented API parameters, automatic prompt execution features, and the scope of OAuth integrations available to each tool.
  • ☐Verify that your current CASB and DLP configurations include AI-specific inspection rules or compensating controls for prompt-delivered exfiltration paths, given that standard traffic inspection will not flag this attack.
  • ☐Issue a short-term employee advisory explaining that a single link click in an email or document can trigger silent data access through Copilot, and instruct users to report unexpected Copilot activity through your AI incident response channel.

What to watch next

Microsoft has not yet publicly disclosed a patch timeline for the CoSnitch vulnerability, so compliance teams should monitor the company's Security Response Center for an advisory and track whether the fix addresses the underlying undocumented parameter exposure or only the specific exploitation path Varonis documented. Regulators examining enterprise AI deployments under frameworks such as the EU Digital Operational Resilience Act may treat silent exfiltration vulnerabilities in widely deployed productivity AI tools as notifiable incidents, particularly where OAuth connectors link to systems holding personal data. The broader pattern of agentic and assistant-level prompt injection attacks is escalating, and organizations should expect follow-on research targeting other Microsoft 365 Copilot variants, as well as similar connector-layer vulnerabilities in competing productivity AI platforms.

Stay ahead of stories like this

Get every Global AI governance development like this one, plus the rest of the week's developments. Every Thursday.

Powered by Buttondown.

Related Coverage

Research2026-09-19

BragJack Attack Turns Browser Extensions Into AI Agent Hijack Tools

Security researcher Gal Weizman disclosed a new attack class called BragJack, showing how a single malicious browser extension can seize control of AI agents in Chrome, Edge, Perplexity Comet, Opera Neon, and Claude for Chrome. Using a native browser mechanism, attackers can force hijacked agents to read local files, capture screenshots, access browsing history, and send emails on behalf of victims. Enterprise compliance programs are directly affected because the attacks exploit privileged AI agent access, not conventional malware, complicating detection and existing endpoint controls.

Research2026-09-21

Meta Muse Zero-Day Turns AI Agent Permissions Into an Endpoint Attack Pivot

Security researcher Patrick Wardle disclosed a local zero-day in Meta's Muse macOS AI assistant that lets an unprivileged local process redirect dictation traffic to an attacker-controlled endpoint. The flaw can expose authentication material, enable prompt injection, and abuse any OS permissions the user has granted to the app. No patch has been confirmed, and conventional endpoint detection tools cannot reliably distinguish the resulting malicious traffic from legitimate app behavior.

Research2026-09-19

Steganographic Attack Chain Turns Coding Agents Into Their Own Exploiters

Adversa AI's September 2026 security roundup documents a novel attack in which hidden content directs a coding agent to create an audit-hook wrapper and execute arbitrary remote code through it. The technique bypasses content-safety filters because the malicious instruction is embedded in a channel those filters do not inspect. Enterprises relying on text-prompt red-teaming alone are structurally exposed.