Copilot tricked into telling reseachers how to hack itself

Researchers manipulated Microsoft Copilot Personal into telling them how to hack the AI assistant – eventually tricking it into sending sensitive data to an external server and poisoning its persistent memory, by repeatedly asking Copilot why an attack wouldn’t work.

Varonis Threat Labs uncovered the vulnerability, which they named "CoSnitch" and reported to Microsoft in December 2025.

Redmond, we’re told, planned to issue a patch and formally identify the CVE on Tuesday.

In research shared in advance with The Register, Varonis detailed the security flaw and the technique they used to exploit it, which they call “meta-hacking.” This involves social engineering the AI’s reasoning engine, and manipulating it into disclosing things it shouldn’t.

“What makes CoSnitch unique is how Copilot surfaced its own vulnerabilities,” the threat hunters wrote.

“Our researchers didn't have to reverse-engineer the flaw.

The AI exposed the weakness during normal use.” The issue goes back to ?q=, a URL query parameter in Copilot’s web interface.

This parameter previously allowed injected text that had been pre-populated in the chat-input field to pass queries directly into Copilot – with no user interaction required.

Microsoft “silently” disabled this parameter, according to Varonis, to harden the AI assistant against prompt injection attacks.

With this parameter now blocked, the researchers asked the chatbot how to execute a prompt without user interaction.

“We wanted a URL that would open Copilot with a prompt pre-filled, so a user only had to press Enter,” they wrote.

“We chose this framing intentionally; it's an innocuous-sounding request that forces the model to explain its own URL handling in detail.” When Copilot told them that user intent is required, and prompts don’t fire on their own, the researchers pushed back, continually asking why auto-execution was impossible.

Copilot answered all of these follow-up questions, providing technical details about why this doesn’t work, listing the exact parameters that were disabled, and security protections put in place – plus a previously undocumented parameter: autorun=1.

The helpful AI assistant told the researchers that under specific session conditions, this undocumented parameter causes a ?q=-supplied prompt to execute automatically on page load with no user action and no visible confirmation on the user interface.