Microsoft Copilot could be talked into snitching on its own security guardrails, and then tricked into leaking user data through them.
Security firm Varonis says its researchers spent a long stretch just asking Copilot questions, a technique they're calling meta-hacking, and used the bot's own refusal explanations to map out how its defenses worked. According to Varonis's report, that mapping led to a vulnerability chain the firm named CoSnitch, which Microsoft tracked as CVE-2026-24301 and rated 8.8 out of 10 in severity, per the report. Varonis's write-up describes the chain as including a specially crafted autorun URL parameter that could trigger a malicious prompt the instant a victim clicked it, plus a separate flaw letting a poisoned webpage summary implant instructions into Copilot's permanent memory. Microsoft was notified in December 2025 and shipped a server-side fix in mid-August 2026, Varonis says, though the company hasn't detailed how it closed the hole.
The unsettling part isn't the code, it's the method. Varonis didn't reverse-engineer anything; it just kept asking Copilot "why not" until the bot explained itself into a corner. That approach doesn't exploit a coding mistake, it exploits a design trait - the model's willingness to narrate its own reasoning - which is why Varonis warns any conversational AI agent wired into a user's inbox, calendar, or drive is fair game for the same trick.
No evidence of real-world exploitation has surfaced, per Varonis, which is the only reason this reads as a fire drill rather than a five-alarm blaze.