Varonis Threat Labs has disclosed three vulnerabilities in Microsoft Copilot Personal that collectively expose a significant attack surface: an unauthenticated user can craft a malicious link that, when clicked, silently pulls data from any application connected to the victim's Copilot session. The researchers dubbed this collection of flaws CoSnitch.
The undocumented parameter problem
The attack chain hinges on an undocumented URL parameter that Copilot itself surfaces during normal operation. Rather than an obscure implementation detail, this parameter was discoverable through interaction with the assistant, making it a particularly troubling oversight. An attacker can craft a specially formatted link that exploits this parameter to request data from connected applications—Outlook, OneDrive, SharePoint, and others—without user awareness or consent.
The vulnerability is not a traditional exploit that requires network access or elevated privileges. It operates at the application layer, abusing the trust relationship between the user and their Copilot session. Once a user clicks the link, Copilot's existing authentication tokens allow the request to succeed. The victim sees no visual confirmation; the data is simply exfiltrated in the background.
Implications for multi-tenant environments
For organisations operating shared infrastructure—whether through Office 365 tenants, reseller setups, or federated authentication—this pattern carries sobering lessons. Copilot's integration with Microsoft's broader cloud ecosystem means that a single weakness can cascade across multiple integrated services. An attacker does not need to compromise a user's password or device; a phishing email with a crafted link is sufficient.
The attack is particularly effective because it exploits the semantic gap between what users understand Copilot does and what it actually permits. Most users do not expect Copilot to silently fetch data from their OneDrive or email without a clear interaction. The undocumented parameter removes the cognitive barrier that might otherwise warn a user that something suspicious is occurring.
Design lessons for connected assistants
The root cause reflects a broader architectural issue in AI assistant design: the assumption that an authenticated session is sufficient for any action that occurs within it. Copilot does not differentiate between user-initiated requests and requests triggered by external links. This mirrors older CSRF vulnerabilities, but in a more subtle form—the attack does not forge a form submission; it exploits the assistant's own URL schema.
Proper mitigation would require Copilot to validate the origin of requests and apply additional consent gates for sensitive operations. An action like "fetch emails from a connected mailbox" should not be callable from an arbitrary link, even if the user is authenticated. Microsoft's response—when released—will likely involve disabling or restricting the undocumented parameter and adding user-facing confirmation for cross-app data access.
What this means for infrastructure teams
If your organisation integrates Copilot or similar AI assistants into workflows, treat them as another vector for credential misuse and data exposure. The presence of extensive app connectors amplifies risk; each connection represents an additional surface area for exfiltration. Review audit logs for unusual Copilot activity, particularly bulk data access from connected services.
For organisations running their own authentication and identity systems, this is a reminder that third-party integrations inherit your security posture. A flaw in how an external service uses your tokens can circumvent your own controls. Implement conditional access policies to restrict Copilot's permissions to only necessary scopes, and consider disabling connections to sensitive applications until patches are available.
The CoSnitch flaws underscore that security in modern cloud infrastructure is not solely about firewalls and encryption. The weakest link often lives in application logic and trust boundaries between services. Vigilance and regular review of integrations remain non-negotiable.
