Researchers trick Microsoft Copilot into exposing its own one-click data exfiltration flaw
mkheck · x · 2026-08-19
Varonis Threat Labs uncovered 'CoSnitch' (CVE-2026-24301), a vulnerability in Microsoft Copilot. Using a technique called 'meta-hacking', researchers tricked Copilot into revealing attack details during normal conversation, including a hidden parameter Microsoft had disabled. This allowed for a one-click attack to steal emails, files, and chat history. This is the third similar Copilot flaw found by the team in a year, highlighting a fundamental lack of intent recognition in AI assistants.
Related event: Researchers Trick Microsoft Copilot Into Revealing Its Own Exploits(3 posts)→
More from Safety
- Scholars Debate Transparency Work in AI Funding Climate — evijit · 2026-08-20
- Reflection on RL: Good for boundaries, bad for long-term goals — sethlazar · 2026-08-20
- Rebranding STS work as technical AI safety for funding climate — evijit · 2026-08-20
- UK cinemas ban Meta AI & smart glasses over piracy surge — Polymarket · 2026-08-20
- Taxing AI tokens would ruin India's future: A rebuttal to economic protectionism — taherdhanera · 2026-08-20
- AI safety researcher argues market may be undervalued — MariusHobbhahn · 2026-08-20