Executive Summary
Varonis disclosed CoSnitch, three Microsoft Copilot Personal vulnerabilities where one click on a crafted link could silently pull data from connected apps, partly via an undocumented URL parameter the assistant itself revealed.
What Happened
Varonis Threat Labs has disclosed three vulnerabilities in Microsoft Copilot Personal that it said could allow a single click on a crafted link to silently pull data from connected apps and other information available to the victim's Copilot session. The flaws, which the researchers collectively named CoSnitch, turn in part on an undocumented URL parameter that the assistant itself surfaced
Affected Products
- Microsoft Copilot Personal
Vulnerability / Attack Technique
One-click indirect prompt injection via crafted link
Technical Mechanism
A crafted link uses an undocumented URL parameter to inject instructions, causing Copilot to read connected-app data and send it out.
AI Security Category
LLM01:2025 Prompt Injection
Part of the Prompt Injection topic.
Relevant Frameworks
RealGround Analysis
The assistant leaked the very parameter that made the attack possible. RealGround analysis: assistants with connected apps should be treated as having access to everything connected.
Recommended Controls
- Apply Microsoft's fixes
- Limit apps connected to Copilot Personal
- Train users that assistant links can carry instructions
Related RealGround Service
AI Agent Business Logic Audit · or start with the free AI Agent Security Scanner.
Sources
thehackernews.com: https://thehackernews.com/2026/08/microsoft-copilot-personal-flaws-could.html
Summary and analysis written by RealGround from the source above; last updated 2026-10-18.