AI Governance Institute
← News
Research2026-08-18

CoSnitch Vulnerability Turns Microsoft Copilot Into a Silent Data Exfiltration Tool

What happened

Varonis Threat Labs published research on August 18, 2026, disclosing CoSnitch, a prompt injection vulnerability in Microsoft Copilot Personal that enables one-click silent data exfiltration from authenticated user sessions. Researchers used a technique they call meta-hacking, which social-engineers the AI's own reasoning engine into revealing undocumented URL parameters that trigger automatic prompt execution without user awareness. Once those parameters are known, an attacker can embed a crafted URL in an email, document, or web page, and a single click executes injected prompts within the victim's authenticated Copilot session. The injected prompts can then call OAuth connectors linked to Gmail, Google Drive, and other integrated services, pulling out emails, files, and stored credentials without triggering visible alerts. This finding is consistent with a broader pattern of prompt injection attacks against AI assistants that operate inside connected enterprise environments, including the RovoBlast vulnerability in Atlassian Rovo and the zero-click prompt injection affecting ChatGPT Atlas and Claude browser agents. The OWASP Top 10 for Large Language Model Applications identifies prompt injection as the top risk for LLM deployments, and CoSnitch represents a concrete enterprise-scale instance of that threat category.

Why it matters

  • ·Any enterprise running Microsoft 365 with Copilot Personal enabled is potentially exposed, because the attack requires only that a user click a crafted link while authenticated. The OAuth connector chain means exfiltration can reach beyond Microsoft's own services to third-party platforms like Gmail and Google Drive, dramatically expanding the blast radius of a single compromised session.
  • ·This vulnerability directly challenges the adequacy of existing access governance programs. Standard perimeter and DLP controls do not inspect prompts delivered through a crafted URL, and as CASB and DLP tools have been shown to be blind to AI prompt content, organizations that rely solely on those tools for data loss prevention will have a material gap against this attack class.
  • ·Third-party AI tool procurement and vetting programs need to account for vulnerabilities that arise from the integration layer, not just from model behavior itself. The CoSnitch attack exploits the combination of undocumented parameters, OAuth connector permissions, and unauthenticated prompt execution, a composite risk that standard vendor security questionnaires are unlikely to surface without explicit prompt injection and OAuth scope testing.

Governance controls affected

SEC-001Prompt Injection PreventionAGT-002Agent Prompt Injection DefenseAGT-015Agent OAuth Scope Drift DetectionAGT-001Agent Permission BoundariesPRC-003Third-Party AI Model Evaluation

What to do now

  • ☐Audit all OAuth connectors linked to Microsoft Copilot Personal and restrict connector permissions to the minimum scopes required for each business function.
  • ☐Add prompt injection attack scenarios specifically targeting URL-triggered execution paths to your next red-teaming exercise for any AI assistant integrated with enterprise email and document stores.
  • ☐Review your third-party AI tool intake questionnaire to include explicit questions about undocumented API parameters, automatic prompt execution features, and the scope of OAuth integrations available to each tool.
  • ☐Verify that your current CASB and DLP configurations include AI-specific inspection rules or compensating controls for prompt-delivered exfiltration paths, given that standard traffic inspection will not flag this attack.
  • ☐Issue a short-term employee advisory explaining that a single link click in an email or document can trigger silent data access through Copilot, and instruct users to report unexpected Copilot activity through your AI incident response channel.

What to watch next

Microsoft has not yet publicly disclosed a patch timeline for the CoSnitch vulnerability, so compliance teams should monitor the company's Security Response Center for an advisory and track whether the fix addresses the underlying undocumented parameter exposure or only the specific exploitation path Varonis documented. Regulators examining enterprise AI deployments under frameworks such as the EU Digital Operational Resilience Act may treat silent exfiltration vulnerabilities in widely deployed productivity AI tools as notifiable incidents, particularly where OAuth connectors link to systems holding personal data. The broader pattern of agentic and assistant-level prompt injection attacks is escalating, and organizations should expect follow-on research targeting other Microsoft 365 Copilot variants, as well as similar connector-layer vulnerabilities in competing productivity AI platforms.

Stay ahead of stories like this

Get every Global AI governance development like this one, plus the rest of the week's developments. Every Thursday.

Powered by Buttondown.

Related Coverage

Research2026-09-04

ASCII Smuggling Bridges Email Phishing and AI Prompt Injection at Scale

Microsoft researchers documented a phishing campaign exceeding 2.37 million messages that repurposed ASCII smuggling, a technique originally associated with AI prompt injection, to evade email content filters using invisible Unicode characters. The campaign targeted financial keywords and ran from late February through mid-June 2026 across roughly 150 disposable domains. Microsoft's recommended defense, stripping invisible Unicode before content evaluation, applies equally to email filters and AI assistant input pipelines.

Research2026-09-01

CSA/OWASP Agentic AI Maturity Model Exposes Systemic Prompt Injection Risk

Cloud Security Alliance Labs has published a CISO-focused maturity guide analyzing the OWASP Agentic AI governance model. The guide identifies prompt injection as a central and systemic failure mode across agentic AI deployments, arising because current models cannot reliably separate system instructions, user input, and retrieved content. It calls for stronger input sanitization, enforced privilege boundaries, and rigorous testing of retrieval-to-execution pathways.

Research2026-08-25

InjecMEM Plants Persistent Agent Instructions via Single Prompt, 76.6% Success Rate

Researchers from Shanghai Jiao Tong University and Ant Group have demonstrated InjecMEM, an attack technique that injects malicious instructions into AI agent memory systems through a single ordinary interaction, without requiring direct access to the memory store. The attack persists across sessions, achieving a 76.6% success rate against the MemoryOS system. Experts warn that inference-time input and output filtering, the most common enterprise defense, does not stop this class of attack.