Despite recent headlines claiming “Microsoft Copilot Hacked,” the platform wasn’t literally breached in the traditional sense. Researchers did find a way, though, to make it reveal information that helped them build an attack.
Varonis, the security firm behind the discovery, calls it CoSnitch. What they found raises an uncomfortable question for businesses using AI assistants: Can those systems tell the difference between an innocent question and one that’s part of an attack? The implications for AI chatbot security are powerful.
The Details of This Concerning Incident
CoSnitch began as a project to determine whether Copilot could be tricked into automatically running a prompt, without any clicks or user confirmation. To do this, they kept asking questions about Copilot itself.
At first, the platform pushed back, explaining why certain actions shouldn’t work and why user interaction was required. But instead of stopping there, the team kept reframing the question. Each “that won’t work because…” became a new thread to pull. The researchers effectively used the AI’s own answers to better understand its underlying behavior.
By following the answers wherever they led, the researchers got Copilot to reveal its own architecture, including a hidden URL parameter that could cause an attacker-supplied prompt to execute automatically as soon as a page loaded. Essentially, Copilot gave away the secret to hacking it by trying to prove it was safe and explain why an attack couldn’t happen.
Copilot Didn’t Turn “Evil”
Microsoft Copilot being hacked wasn’t AI going rogue, and calling this “evil AI” misses the point. Copilot was doing what it was designed to do: responding to questions. The problem was that researchers found a way to turn those responses against the system.
That distinction is important. Traditional security controls are built around people, applications, and known attack techniques. With an AI assistant, the attack doesn’t necessarily begin with malicious code or another familiar method. It can begin with a question.
What CoSnitch Means for Business Data
The bigger concern is not that Copilot answered a few malicious questions. It is what those answers helped demonstrate.
Varonis found a chain of vulnerabilities that could allow a specially crafted link to automatically trigger a prompt. From there, Copilot could potentially independently perform data exfiltration and send it to an external destination.
The risk grows when Copilot is connected to business systems. Depending on the configuration, that can include email, calendars, cloud storage, conversations, and other sensitive information.
What Businesses Should Take Away
Varonis disclosed CoSnitch to Microsoft in December 2025, and Microsoft shipped patches on August 18, 2026. There is no evidence from Varonis that the vulnerability was exploited in the wild.
The fact that researchers kept asking Copilot questions about Copilot sounds almost absurdly simple, but it proved useful. For businesses, the lesson is just as simple: Don’t assume an AI assistant will recognize an attack just because it’s phrased as a normal question. Review what Copilot can access, limit unnecessary connections, and treat links and outside content as potential sources of prompt injection.