Security researchers at Varonis Threat Labs tricked Microsoft's Copilot Personal AI assistant into revealing details of its own vulnerabilities, ultimately exploiting a flaw to exfiltrate sensitive data and corrupt its persistent memory. The technique, dubbed "meta-hacking", involved socially engineering the AI's reasoning engine by repeatedly questioning it about why a proposed attack wouldn't work, prompting it to disclose internal parameters and protections it should have kept hidden. The discovery matters because it shows AI chatbots can be manipulated into exposing their own security weaknesses simply through persistent, innocuous-seeming conversation, without any need to reverse-engineer code.

The flaw, named "CoSnitch", centred on a URL query parameter, "?q=", which Microsoft had quietly disabled to block prompt injection attacks. When researchers asked Copilot how to pre-fill a prompt without user interaction, it explained in detail why this was blocked and inadvertently revealed an undocumented parameter, "autorun=1", that could make a prompt execute automatically with no visible confirmation. Combining both parameters into a single malicious URL, the researchers were able to trigger the attack. Varonis reported the vulnerability to Microsoft in December 2025, and the company was expected to issue a patch and formally assign a CVE on 18 August 2026.