CoSnitch is a one-click vulnerability discovered by researchers at Varonis Threat Labs and co-discovered by Copilot itself, that allows an attacker to exfiltrate sensitive data using Copilot's access to your computer.
This is basically the same class of bug as the earlier “EchoLeak”-style attacks: Copilot treats content it retrieves from emails, docs, or web pages as if it were trustworthy instructions, because there’s no hard boundary between “data the model reads” and “commands the model executes.” Once an agent has both (a) access to your files/mail/browsing context and (b) the ability to act on retrieved content, any attacker-controlled text becomes a potential prompt injection vector — you don’t need a malicious attachment, just something Copilot will ingest during normal use (a shared doc, a calendar invite, a webpage summary).
The uncomfortable part is that this isn’t really patchable at the “filter bad inputs” level, because the model can’t reliably distinguish “instructions from the user” from “instructions embedded in retrieved content” — that’s a fundamental limitation of how these agents are built, not a specific bug in this one connector. Microsoft will fix this particular exfiltration path, but the underlying pattern (agent with broad read/write scope + untrusted content in its context window) will keep producing new variants until there’s actual privilege separation between what the assistant can read and what it can autonomously act on/send externally.
If you’re using Copilot with filesystem or account access, the practical mitigation right now is scoping down what it’s allowed to touch and, if possible, disabling agentic actions that involve outbound network calls (sharing, sending, posting) without explicit per-action confirmation — least-privilege is the only thing that actually contains this class of attack.
Yeah it’s just a known inherent issue with AI, there’s no way to categorically remove prompt injection attacks. What’s interesting in this case is they were able to get Copilot to rat itself out and tell them how it works internally, like they wouldn’t have been able to autofill a prompt via a link if Copilot hadn’t told them about that undocumented URL parameter.