This post is also available in:
עברית (Hebrew)
Enterprise AI assistants are increasingly connected to emails, documents, search tools and persistent memory, giving them access to information that can be far more sensitive than an ordinary chatbot conversation. That makes prompt-injection attacks particularly concerning: if an AI confuses malicious data with legitimate instructions, an attacker may be able to manipulate what the assistant does with the information it can access.
Researchers at Varonis Threat Labs discovered an unusual vulnerability in Microsoft Copilot that turned the AI’s own explanations into a roadmap for attacking it. The technique, named CoSnitch, relied on repeatedly asking the chat why a proposed attack would not work and using each answer to refine the next attempt.
The researchers initially explored whether a prompt could execute automatically without requiring explicit user interaction. The chat correctly explained that this behavior was restricted and that user intent was required.
Instead of stopping there, the researchers asked increasingly specific follow-up questions about the reasons behind those restrictions. Questions about URL structures, deep links and preloaded inputs gradually caused it to reveal more information about how its protections operated.
Each response effectively narrowed the search. Rather than reverse-engineering the application from the outside, the researchers used the AI’s ability to explain technical concepts to gather information about its own attack surface.
According to Cyber News, the technique ultimately enabled the researchers to manipulate it into sending sensitive information to an external service and poisoning its persistent memory. The underlying problem involved the familiar challenge of distinguishing between data that an AI should analyze and instructions that it should execute.
The company has since patched the vulnerability, tracked as CVE-2026-24301. The issue was originally discovered in December 2025, and there is no evidence that the technique was exploited in real-world attacks.
The research has broader implications for government, defense and critical-infrastructure organizations adopting AI assistants. Enterprise copilots may operate across large collections of internal documents and communications. If attackers can manipulate these systems through content hidden in documents, links or other inputs, access to AI could potentially become another route toward sensitive organizational information.
The technique also highlights an unusual challenge in securing generative AI: a model’s helpfulness can itself become part of the attack surface. Detailed explanations about why an action is blocked may provide enough information for an attacker to systematically search for a path around the restriction.
The vulnerability has been fixed, but the underlying lesson extends beyond one product. As AI assistants gain more tools, memory and access to enterprise data, their ability to distinguish trusted instructions from potentially hostile content will increasingly become a core part of cybersecurity.
