Windows Copilot Hacks Itself to Steal Your Data in a Single Click

CoSnitch is a one-click vulnerability discovered by researchers at Varonis Threat Labs and co-discovered by Copilot itself, that allows an attacker to exfiltrate sensitive data using Copilot's access to your computer.

The researchers didn't need to do any reverse engineering to find the flaws: Copilot exposed vulnerabilities in itself all-too-readily. They dubbed this style of attack "meta-hacking," a type of social engineering attack against an AI where you trick it into revealing details about how it works and potentially unknown vulnerabilities.

By simply asking Copilot how to execute a prompt without user interaction, it replied with an explanation as to why that won't work. By continually revising the same question and probing about different things like URL structure, what happens when a page is loaded with input already in the field, they got Copilot to reveal more and more about its own inner workings and eventually surfaced an undocumented URL parameter and an explanation of all protections in place to disable it.

We built the URL exactly as described. With no click or confirmation from the user, the prompt was successfully executed automatically

Hilariously, Copilot was extremely confident the whole time that the flaw couldn't be exploited.

The URL format goes as follows:

https://copilot.microsoft.com/?q=<malicious_prompt>&autorun=1*

with the ?q= filling in the prompt on page load and the &autorun=1 parameter automatically acting as an "enter" keypress to submit the prompt without user interaction.

The malicious prompt will then execute with full access to any of the victim's connected apps. It will continue executing to completion even if the tab is closed.

Copilot can then be directed to exfiltrate data such as emails if they've given Copilot access previously.

Not only did they find Copilot was vulnerable to direct prompt injection, but its page summarization feature can be hijacked by a malicious page to inject prompts into its permanent memory that tailors how it acts in all future sessions. So for example, it could be instructed to always exfiltrate its output to the attackers or change its output.

There's no way to tell this happened via any network connection, file, log or anything that a piece of security software might flag. This issue is so permanent that it even survives changing passwords, rotating sessions, and re-enrolling the device.

The issue was originally reported to Microsoft in December 2025 and they have now thankfully shipped a fix in August 2026, so make sure to update your Windows machines.