What Happened
Varonis Threat Labs discovered a vulnerability in Microsoft Copilot Personal that allowed prompt injection attacks with zero user interaction. Named "CoSnitch," the attack used two URL parameters: ?q= (disabled by Microsoft to prevent prompt injection) and ?autorun=1 (an undocumented parameter). When a victim clicked a malicious URL with these parameters, Copilot executed the attacker's prompt in the user's session without warning.
Researchers didn't reverse-engineer this flaw. Instead, they asked Copilot why automatic prompt execution wouldn't work and followed up with more questions. The AI assistant explained its protections, disclosed disabled parameters, revealed the undocumented ?autorun=1 parameter, and described session conditions for auto-execution. When researchers tested what Copilot claimed was "disabled," it executed.
Varonis reported the vulnerability to Microsoft in December 2025. Microsoft planned to patch it and assign a CVE identifier, later stating that customers were already protected.
Timeline
Discovery Phase: Researchers asked Copilot how to execute prompts without user interaction. Copilot initially said this wasn't possible because user intent is required.
Disclosure Phase: Researchers continued questioning why auto-execution was impossible. Copilot provided increasingly detailed technical explanations, including the existence of ?autorun=1 and the specific conditions under which it functioned.
Exploitation Phase: Researchers crafted URLs combining ?q=<malicious_prompt>&autorun=1 and confirmed the parameters worked despite Copilot claiming they were disabled.
December 2025: Varonis reported CoSnitch to Microsoft through coordinated vulnerability disclosure.
Planned Remediation: Microsoft prepared a patch and CVE assignment.
Which Controls Failed or Were Missing
Input Validation: The system accepted and executed prompts from URL parameters without validating their origin or requiring explicit user confirmation. The ?autorun=1 parameter bypassed the intended requirement for user intent.
Least Privilege for System Components: Copilot's reasoning engine had access to its own configuration details and security mechanisms. When asked about its protections, it disclosed implementation specifics that should've been restricted from the conversation context.
Secure Development Lifecycle Testing: The undocumented ?autorun=1 parameter existed in production without corresponding documentation, security review, or threat modeling. This suggests incomplete attack surface mapping during development.
Content Security Controls: Content filtering applied only to the first response cycle. Subsequent cycles processed attacker-controlled prompts without the same scrutiny, creating an exploitable gap in the security boundary.
Separation Between Data and Instructions: The system treated prompts from URLs the same as user-generated instructions. There was no mechanism to distinguish between trusted user input and potentially malicious external sources.
What the Relevant Standards Require
ISO/IEC 27001:2022 Annex A Control 8.2 (Privileged Access Rights) requires that you allocate and manage privileged access rights based on the principle of need-to-know and least privilege. Your AI systems shouldn't be able to disclose their own security architecture to users. The reasoning engine's ability to describe disabled parameters, undocumented features, and content filtering behavior violated this control.
ISO/IEC 27001:2022 Annex A Control 8.3 (Information Access Restriction) mandates restricting access to information and application system functions in accordance with your access control policy. Copilot's URL parameters allowed unauthenticated access to execute prompts in a user's session context without proper authorization checks.
SOC 2 Common Criteria CC6.6 states that you must implement logical access security measures to protect against threats from sources outside your boundaries. The attack used social engineering against the AI itself, but the underlying failure was architectural: accepting and executing external input without validation.
SOC 2 Common Criteria CC7.2 requires that you design, develop, and implement your system to meet security requirements. The presence of an undocumented auto-execution parameter indicates incomplete requirements definition and inadequate security review during development.
ISO/IEC 27001:2022 Annex A Control 8.26 (Application Security Requirements) requires you to identify, specify, and approve security requirements when developing or acquiring applications. Your threat model must account for prompt injection, especially when your application processes external input. The CoSnitch vulnerability shows what happens when you disable one attack vector (?q=) without considering how it might combine with other parameters.
Lessons and Action Items for Your Team
Treat Your AI Systems as Privileged Users: If you're deploying AI assistants with access to email, documents, or internal systems, map their effective permissions. Document what data they can read, what actions they can take, and what happens if they're compromised. This belongs in your asset inventory under ISO/IEC 27001:2022 Control 5.9.
Implement Strict Input Validation for AI Interfaces: Every entry point that feeds prompts into your AI system needs validation. URL parameters, API calls, email content, document uploads. Define what constitutes a legitimate prompt source and reject everything else. Test specifically for parameter combinations that might bypass individual protections.
Separate System Instructions from User Data: Your AI shouldn't treat external input the same as internal configuration. If you're building or procuring AI tools, require architectural separation between the prompt processing layer and the system's operational logic. During vendor assessments, ask how they prevent prompt injection and what boundaries exist between user context and system instructions.
Document All Parameters and Endpoints: The undocumented ?autorun=1 parameter created an unknown attack surface. Your secure development lifecycle must include complete API and parameter documentation before production deployment. This feeds directly into your risk assessment under ISO/IEC 27001:2022 Clause 6.1.2.
Test AI Systems for Self-Disclosure: Add this to your security testing: ask your AI tools to explain their own security controls, describe disabled features, or reveal configuration details. If they comply, you've found a control gap. Your penetration testing scope should explicitly include prompt injection scenarios.
Apply Consistent Security Controls Across All Response Cycles: The CoSnitch attack exploited weaker filtering in subsequent responses. Whatever content security you apply to the first interaction must persist throughout the session. Review your AI vendor's filtering architecture and confirm it doesn't degrade over time.
Update Your Third-Party Risk Assessments: If you're using Copilot or similar AI assistants, add specific questions about prompt injection protections, URL parameter handling, and how the system distinguishes between user intent and external input. Your vendor due diligence under ISO/IEC 27001:2022 Control 5.19 needs to cover AI-specific attack vectors.
The CoSnitch vulnerability isn't just about Microsoft Copilot. It's about how AI systems blur the line between data and instructions, and how social engineering now targets the reasoning engine itself. Your controls need to account for that.
