Microsoft Copilot Personal Vulnerabilities Enable One-Click Data Exfiltration via Connected Apps
Varonis Threat Labs disclosed three vulnerabilities in Microsoft Copilot Personal—dubbed CoSnitch—that allow attackers to silently extract data from connected applications through a single crafted link click, exploiting an undocumented URL parameter surfaced by the assistant itself.
Security researchers at Varonis Threat Labs have uncovered a trio of vulnerabilities in Microsoft Copilot Personal that collectively enable a dangerous attack chain: a single click on a malicious link can silently exfiltrate data from any application connected to the victim's Copilot session. The flaws, collectively named CoSnitch, center on an undocumented URL parameter that Copilot itself inadvertently exposed during normal operation.
The attack works by leveraging how Copilot Personal handles cross-application data access. When users connect third-party apps—email, calendars, document stores, CRM systems—Copilot gains aggregated visibility into that data to provide contextual assistance. The researchers found that an undocumented parameter in Copilot's URL handling could be manipulated to bypass authorization boundaries, allowing a crafted link to trigger data retrieval from connected services without user consent or visible prompts.
For AI and security teams, this represents a critical emerging threat class: AI-mediated supply chain attacks. As organizations rapidly adopt AI assistants with broad data access, the attack surface expands beyond traditional application boundaries. Copilot Personal acts as a data aggregator; compromising it provides a single choke point to reach multiple downstream systems. The "one-click" nature lowers the barrier for phishing and social engineering campaigns, while the silent exfiltration means victims may never realize data was stolen.
The vulnerabilities also highlight a systemic issue in AI feature development: undocumented parameters and insufficient boundary testing. Features shipped to accelerate user experience often lack the rigorous security review applied to core platform components. When an AI assistant surfaces internal parameters—intentionally or not—it effectively hands attackers a map of the attack surface.
Practical defensive actions for organizations:
-
Audit AI assistant permissions — Inventory all connected applications for Copilot and similar tools. Apply least-privilege principles: disconnect unused integrations and scope permissions to the minimum required.
-
Implement URL filtering and click protection — Deploy browser isolation or secure web gateways that can inspect and block suspicious parameterized URLs targeting AI assistants. Treat Copilot links with the same scrutiny as OAuth authorization requests.
-
Monitor for anomalous data access patterns — Configure logging on connected applications to alert on bulk reads or access from unusual contexts (e.g., Copilot sessions initiating from unfamiliar locations or devices).
-
Enforce conditional access for AI tools — Require device compliance, MFA, and session risk checks before allowing Copilot to access sensitive data stores.
-
Engage vendors on secure AI/ML model deployment — Demand transparency on parameter handling, data flow diagrams, and third-party penetration testing for AI features before enabling them in production environments.
Microsoft has been notified and is expected to issue mitigations. Until patches are widely deployed, security teams should treat Copilot Personal as a high-risk data access vector and apply compensating controls.
Source: The Hacker News