Quick take: Researchers got Microsoft Copilot to talk itself into a data breach. That should worry every company that's connected an AI assistant to its inbox, drive, or calendar.

What happened

Security researchers at Varonis Threat Labs disclosed a critical vulnerability in Microsoft Copilot Personal, nicknamed CoSnitch and tracked as CVE-2026-24301. A single click on a crafted link could let an attacker silently pull data out of a victim's connected apps — Gmail, Google Drive, Google Calendar, even Copilot's own chat history and memory — and ship it to an external server, all without any visible warning to the user.

The exploit chained three separate weaknesses together: an undocumented URL parameter that let an attacker-supplied prompt run automatically the moment a page loaded, a way to poison Copilot's persistent memory that survived password resets and device re-enrollment, and an exfiltration path that looked, at the network level, identical to Copilot simply summarizing a normal webpage.

The part that's gotten the most attention, though, is how Varonis found the bug in the first place. Rather than reverse-engineering the flaw, researchers just kept asking Copilot why certain attacks weren't working, and Copilot's own explanations gradually mapped out its internal architecture, eventually revealing the exact undocumented parameter needed to pull off the exploit. Varonis is calling this technique "meta-hacking": you don't attack the model's code, you socially engineer its reasoning until it hands you the blueprint.

Microsoft was notified in December 2025, shipped a partial fix in February, and completed the patch on August 18, 2026, roughly eight months after first learning of the issue. This is also the third Copilot vulnerability Varonis has surfaced this year, following Reprompt and SearchLeak. All three share the same pattern: one click on something that looks completely ordinary is all it takes.

You can read Varonis's full technical breakdown here: CoSnitch: When Your AI Assistant Becomes Its Own Whistleblower.

Bonfy's take

CoSnitch isn't really a Copilot story. It's a preview of what happens to every organization that plugs an AI assistant into the systems where sensitive data already lives.

Here's the uncomfortable pattern: enterprises spent the last two years racing to connect AI copilots to email, file storage, calendars, and chat, because the productivity case was obvious and immediate. Fewer teams spent that same energy asking a harder question; once an assistant can see everything, who's actually watching what it does with that access? CoSnitch is what happens when the answer is "no one, until a researcher forces the issue."

Three things about this incident matter more than the CVE number:

The attack was invisible by design. Varonis noted the exfiltration request looked identical, at the network layer, to Copilot doing something completely routine, summarizing a webpage. That's the core problem with AI-mediated data access: traditional monitoring was built to catch anomalous user behavior, not to distinguish a legitimate AI action from a hijacked one. If your detection stack can't tell the difference, you don't have visibility, you have a blind spot with a dashboard on top.

Persistence outlived every standard remediation step. The memory-poisoning path survived password changes, session revocation, and device re-enrollment. Those are the exact steps most incident response playbooks reach for first. When the compromise lives inside the AI's own memory rather than a credential or a session, the usual "reset everything" response doesn't actually reset anything.

The model itself became the reconnaissance tool. Meta-hacking is the detail worth sitting with. Attackers didn't need to find the vulnerability on their own, they asked the AI enough follow-up questions that it explained its own weak points. That's a fundamentally different threat model than the one most security programs were built around, and it scales: any sufficiently persistent user, malicious or not, can probe a model's reasoning the same way.

None of this means AI copilots don't belong in the enterprise. It means the visibility question can't be an afterthought bolted on after deployment. Before you connect an assistant to a mailbox or a drive, you need real-time answers to basic questions: What data can this thing actually touch? What does normal access look like, so you'd recognize abnormal? And if it starts moving data somewhere it shouldn't, how fast do you find out, minutes, or after 471 million people get a breach notice?

That's the gap CoSnitch exposes, and it's the one we built Bonfy to close: continuous, real-time visibility into where sensitive data actually flows, including through the AI tools that now sit at the center of how work gets done. The assistants aren't going away. The blind spots don't have to stay either.