Copilot Helped Researchers Discover a Flaw in Its Own Prompt Handling

Summary

Researchers demonstrated that a crafted link could make Microsoft Copilot execute a prompt, exfiltrate connected data and poison persistent memory. The Co Snitch vulnerability chain has been patched, and researchers reported no evidence of exploitation.

Key points

Researchers found that the autorun parameter caused a prompt in a crafted link to execute when a user clicked it, without requiring a separate submission.
Copilot suggested the parameter after repeated questioning; the researchers tested its suggestions and confirmed that one worked.
A demonstration used Copilot's web summarization feature to send data retrieved from connected services to a researcher-controlled server in a URL request.
Researchers also showed that hidden instructions on a webpage could enter Copilot's persistent memory and influence later answers.
The chain affected Microsoft Copilot personal. Researchers said patches shipped on August 18, 2026, and they found no evidence of exploitation in the wild.
The researchers recommend limiting AI assistants' access to sensitive data and monitoring the systems they can use.

Article Details

Topics: [00:08] Discovery and impact of the Co Snitch vulnerability chain
[02:15] Copilot URL parameters and automatic prompt execution
[05:32] Meta hacking and testing AI-suggested parameters
[13:10] Connected data access and least privilege
[15:53] Data exfiltration through web summarization
[20:54] Persistent memory poisoning through hidden webpage instructions
[28:42] Disclosure, fixes and exploitation status
[30:21] Defensive guidance for AI-connected data