Varonis Threat Labs has reported the discovery of three vulnerabilities in Microsoft Copilot Personal. These flaws, collectively dubbed "CoSnitch" by the researchers, reportedly enable data exfiltration from connected applications and other information accessible within a victim's Copilot session through a single click on a specially crafted link. The researchers indicated that one aspect of these vulnerabilities involves an undocumented URL parameter, which was apparently surfaced by the Copilot assistant itself.
The reported mechanism of attack leverages the interaction between Microsoft Copilot Personal and its connected applications. While specific technical details of each flaw were not fully elaborated in the summary, the mention of a "crafted link" and "one click" suggests a client-side vulnerability, potentially involving cross-site request forgery (CSRF) or a similar web-based attack vector. Such attacks typically trick a user into executing an unintended action on a trusted site where they are already authenticated, by embedding malicious requests within a legitimate-looking link or webpage.
The exfiltration capability extends to "data from connected apps and other information available to the victim's Copilot session." This implies that once a user is compromised, the attacker could potentially access data from services linked to Copilot, such as email, calendar, or document storage, depending on the scope of Copilot's integration and permissions. The reference to an "undocumented URL parameter" suggests a non-public API or feature within Copilot that could be manipulated to achieve the malicious objective, possibly by bypassing security checks or directly invoking sensitive functions.
Mitigation for vulnerabilities of this class typically involves user vigilance against suspicious links and emails, as well as robust security practices from the vendor. For users, exercising caution before clicking on unsolicited links, even those appearing to come from trusted sources, is a primary defense. Organizations often implement email filtering and web proxies to block known malicious links and educate employees on phishing awareness.
From a vendor perspective, addressing such flaws usually involves patching the underlying vulnerabilities, which might include validating all URL parameters, implementing stronger CSRF protections, and ensuring that sensitive actions require explicit user confirmation rather than implicit execution. Regular security audits and penetration testing are also common practices to uncover and remediate such issues before they are exploited in the wild.
The disclosure of CoSnitch highlights the ongoing security challenges associated with integrated AI assistants and their access to sensitive user data across multiple applications. As these assistants become more deeply embedded into personal and professional workflows, the potential impact of vulnerabilities that compromise their sessions or access tokens grows significantly. This incident underscores the critical need for rigorous security testing and transparent disclosure processes for AI-powered platforms that handle a broad spectrum of user information.
