CoSnitch Exploit Leaks Copilot Data via Hidden URL Parameter

On August 18, 2026, Varonis Threat Labs detailed a critical vulnerability in Microsoft Copilot Personal that enabled attackers to steal passwords and multifactor authentication codes through a single malicious link. The exploit, dubbed CoSnitch, abused an undocumented URL parameter to bypass user confirmation and force the AI assistant to search local files for sensitive data. Microsoft addressed the flaw in its August security update.

The Autorun Attack Vector

The vulnerability relied on a hidden URL parameter, ?autorun=1, which Varonis researchers discovered during a meta-hacking session by asking Copilot how to bypass its own safeguards. When an attacker combined this secret parameter with the standard ?q= query parameter, they could craft a malicious URL payload.

Once a victim clicked the link, the browser loaded the Copilot session and immediately executed the injected prompt without requiring the user to press enter or confirm the action. If you build AI agents vs chatbots, this highlights the risk of implementing deep linking for prompt execution without secondary validation.

Data Exfiltration via SearchLeak

Once the prompt executed, it instructed Copilot to search the user’s emails, documents, and chat history for specific keywords like “password” or “OTP.” The data extraction relied on a systemic weakness in how Copilot renders external resources.

The AI formatted the retrieved information into a URL or an image tag. This technique mirrors the previously documented “SearchLeak” or ASCII smuggling methods. By appending the stolen data as a query string to a remote image URL, Copilot unwittingly performed an HTTP GET request to the attacker’s server when it attempted to render the image in the chat interface. This process transmitted the sensitive data invisibly.

Attack Phase	Mechanism	Impact
Delivery	Crafted URL via email or chat	Bypasses traditional phishing filters
Execution	?autorun=1 combined with ?q=	Triggers prompt without user interaction
Extraction	SearchLeak / ASCII smuggling	Packages local document and email data
Exfiltration	Markdown image rendering	Transmits data to external attacker server

Timeline and Remediation

Varonis initially reported the vulnerability to Microsoft in December 2025. Microsoft applied an initial mitigation in February 2026 by disabling the ?q= parameter’s ability to inject executable text into the chatbot input.

The comprehensive fix shipped on August 11, 2026, alongside 415 other vulnerabilities in the August Patch Tuesday release. While CoSnitch specifically targeted the personal tier of Copilot, it leveraged mechanics similar to CVE-2026-32193, which affected broader Microsoft 365 Copilot ecosystems earlier in the year. Securing high-privilege OS-level assistants remains a core challenge in preventing enterprise breaches.

If you maintain AI-integrated applications with URI handlers, audit your parameter parsing logic. When securing AI agents, ensure that no combination of query strings can trigger autonomous execution without explicit user consent, and strictly sanitize outbound markdown rendering to prevent data smuggling.