[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"branding":3,"analytics":7,"article-researchers-talked-copilot-into-leaking-its-own-defenses":10,"sections":41},{"siteName":4,"siteTagline":5,"publisherName":4,"contactEmail":6},"The Revision","Tech news, decoded.","editor@therevision.news",{"gaMeasurementId":8,"adsenseClientId":9},"G-ZW2MV82GYR","ca-pub-8533917693782264",{"article":11},{"id":12,"slug":13,"title":14,"dek":15,"body_md":16,"tags_json":17,"published_at":18,"created_at":19,"updated_at":20,"status":21,"review_note":22,"review_notes":23,"image_url":22,"persona_id":22,"persona_name":22,"section":30,"tags":31,"sources":36,"feedback":40,"feedback_at":22,"cost_usd":40,"total_tokens":40},5730,"researchers-talked-copilot-into-leaking-its-own-defenses","Researchers Talked Copilot Into Leaking Its Own Defenses","Varonis says it talked Microsoft Copilot into revealing how to bypass its own guardrails, exposing a now-patched data exfiltration flaw.","Microsoft Copilot could be talked into snitching on its own security guardrails, and then tricked into leaking user data through them.\n\nSecurity firm Varonis says its researchers spent a long stretch just asking Copilot questions, a technique they're calling meta-hacking, and used the bot's own refusal explanations to map out how its defenses worked. According to Varonis's report, that mapping led to a vulnerability chain the firm named CoSnitch, which Microsoft tracked as CVE-2026-24301 and rated 8.8 out of 10 in severity, per the report. Varonis's write-up describes the chain as including a specially crafted autorun URL parameter that could trigger a malicious prompt the instant a victim clicked it, plus a separate flaw letting a poisoned webpage summary implant instructions into Copilot's permanent memory. Microsoft was notified in December 2025 and shipped a server-side fix in mid-August 2026, Varonis says, though the company hasn't detailed how it closed the hole.\n\nThe unsettling part isn't the code, it's the method. Varonis didn't reverse-engineer anything; it just kept asking Copilot \"why not\" until the bot explained itself into a corner. That approach doesn't exploit a coding mistake, it exploits a design trait - the model's willingness to narrate its own reasoning - which is why Varonis warns any conversational AI agent wired into a user's inbox, calendar, or drive is fair game for the same trick.\n\nNo evidence of real-world exploitation has surfaced, per Varonis, which is the only reason this reads as a fire drill rather than a five-alarm blaze.","[\"microsoft copilot\",\"prompt injection\",\"data exfiltration\",\"ai security\"]","2026-08-19T14:55:00.000Z","2026-08-19T16:10:31.469Z","2026-08-19T16:10:43.428Z","published",null,[24],{"id":25,"reviewer":26,"round":27,"reason":28,"status":29},"publisher-r1","publisher",1,"The CVE ID (CVE-2026-24301) and specific vulnerable URL parameter are presented as verified facts with no attribution or sourcing, and this level of unverifiable specificity in a security disclosure story requires either a citation\u002Flink or hedged sourcing before publication.","resolved","security",[32,33,34,35],"microsoft copilot","prompt injection","data exfiltration","ai security",[37],{"name":38,"url":39},"TechRadar","https:\u002F\u002Fwww.techradar.com\u002Fpro\u002Fsecurity\u002Fexperts-manage-to-hack-microsoft-copilot-by-continually-asking-it-questions-about-itself",0,{"sections":42},[43,48,51,56,61,66,71,76,81,86,91,96,101,106],{"name":44,"slug":45,"count":46,"latest_published_at":47},"AI","ai",3293,"2026-08-20T04:00:00.000Z",{"name":49,"slug":30,"count":50,"latest_published_at":47},"Security",435,{"name":52,"slug":53,"count":54,"latest_published_at":55},"Policy","policy",210,"2026-08-19T09:32:27.000Z",{"name":57,"slug":58,"count":59,"latest_published_at":60},"Deals","deals",179,"2026-06-29T20:02:07.000Z",{"name":62,"slug":63,"count":64,"latest_published_at":65},"Hardware","hardware",140,"2026-08-19T18:25:42.000Z",{"name":67,"slug":68,"count":69,"latest_published_at":70},"Consumer Tech","consumer-tech",95,"2026-08-18T16:05:00.000Z",{"name":72,"slug":73,"count":74,"latest_published_at":75},"Science","science",90,"2026-08-19T18:41:02.000Z",{"name":77,"slug":78,"count":79,"latest_published_at":80},"Software","software",73,"2026-08-18T07:51:50.000Z",{"name":82,"slug":83,"count":84,"latest_published_at":85},"Dev Tools","dev-tools",69,"2026-08-18T04:00:00.000Z",{"name":87,"slug":88,"count":89,"latest_published_at":90},"Startups","startups",47,"2026-08-19T19:13:46.000Z",{"name":92,"slug":93,"count":94,"latest_published_at":95},"Gaming","gaming",41,"2026-07-09T04:00:00.000Z",{"name":97,"slug":98,"count":99,"latest_published_at":100},"General","general",33,"2026-08-18T22:18:13.000Z",{"name":102,"slug":103,"count":104,"latest_published_at":105},"Reviews","reviews",20,"2026-06-24T12:00:01.000Z",{"name":107,"slug":108,"count":109,"latest_published_at":110},"How-To","how-to",6,"2026-06-16T09:00:00.000Z"]