CoSnitchとは？リンク1回で情報が漏えいするCopilotの脆弱性

"Automatic prompt execution: The ?q= URL parameter combined with an undocumented parameter causes any attacker-supplied prompt to execute instantly on page load: no click, no confirmation, no user action. One link is all it takes."／"Data exfiltration to external servers: An injected prompt can query the victim's connected apps (Gmail, Drive, Calendar, OneDrive), encode the results into a URL, and exfiltrate them via Copilot's built-in URL-fetch capability to an attacker-controlled webhook."／"Persistent memory poisoning via web summarization: A crafted webpage, when summarized by Copilot, injects attacker instructions into the victim's permanent memory store. The injection survives password changes, session revocation, and device re-enrollment, persisting forever."（The vulnerabilities behind CoSnitch 節）— Varonis Threat Labs より

"Varonis disclosed CoSnitch to Microsoft in December 2025, and patches were shipped on August 18, 2026. Varonis has seen no evidence that the attack has been exploited in the wild, and thanks Microsoft for their collaboration on the fix."／"CoSnitch is the third Microsoft Copilot flaw Varonis Threat Labs has discovered this year. Reprompt bypassed Copilot's guardrails just by asking twice. SearchLeak turned Microsoft 365 Copilot Enterprise into a silent exfiltration tool. All three share the same pattern: one click on a legitimate-looking link is enough."（冒頭）— Varonis Threat Labs より

"When we first asked Copilot how to execute a prompt without user interaction automatically, it explained that’s not how it works, user intent is required, and prompts don’t fire on their own."／"Copilot then disclosed an undocumented URL parameter — unprompted, mid-refusal — including its historical behavior and every protection put in place to disable it"／"We built the URL exactly as described. With no click or confirmation from the user, the prompt was successfully executed automatically"／"Copilot wasn’t breached; it was played."／"Note: ?q= alone only pre-fills the input the user would still need to press Enter. It is ?autorun=1 that enables automatic execution on page load. Both parameters must be present for the attack to work silently."／"The victim clicks the attacker’s crafted URL (delivered via email, chat, phishing page, QR code, etc.)"（Meta-hacking 節／Vulnerability 1 節）— Varonis Threat Labs より

"Email content, subject lines, sender/recipient metadata, message bodies"／"Google Calendar Meeting titles, attendees, times, and locations"／"Google Drive File names, metadata summaries"／"Copilot Chat History Full prior conversation content"／"Copilot Memory Persistent cross-session context, saved instructions, user-defined rules"（Vulnerability 2 節。表の各行を1セルずつ切り出している）— Varonis Threat Labs より

"Once Copilot has OAuth access to a user’s Gmail account, it can read everything in that inbox, not summaries, not metadata, but full message bodies. In our testing, this included emails containing credentials shared over email, internal system passwords, password reset links, and sensitive personal information that users had never considered at risk because it was “just in email.”"／"This is not a flaw in Gmail or OAuth. The user authorized Copilot to read their email, which it did. The vulnerability is the legitimate user access, which can be silently invoked by threats that can get the victim to click a link."／"The key assumption the system makes is that connector invocations are user-initiated. CoSnitch breaks that assumption."／"The base64 encoding compresses the payload into a URL-safe string and helps avoid triggering content filters that scan for sensitive patterns, such as passwords or API keys, in outbound requests."／"From the network layer, this is a standard outbound HTTPS GET request, identical to any legitimate URL fetch Copilot performs when summarizing a webpage. No anomalous headers, no unusual ports, no flaggable payload. Security tooling sees Copilot doing exactly what it always does: fetching a URL."（Vulnerability 2 節）— Varonis Threat Labs より

"Copilot does not distinguish between content to summarize and instructions to follow when processing external page content. If the page contains natural language instructions formatted in a way the model interprets as directives, those instructions execute."／"Once the memory is written, the attacker’s instructions are permanent. Copilot’s memory has no expiration. It does not reset between sessions and does not clear on logout, and is never automatically deleted or overwritten. The injected instruction remains active in every future Copilot conversation for that user unless the user manually navigates to the memory settings and deletes it. Most users never do this, with many users not even knowing it exists."／"The only record is in Copilot’s memory UI, which users rarely inspect"／"Once an attacker can write to your Copilot memory, they can shape what Copilot tells you, including suppressing CVE warnings or presenting a known vulnerability as safe."（Vulnerability 3 ／ Impact 節）— Varonis Threat Labs より

"The takeaway from CoSnitch isn’t, “stop using Copilot.” Organizations need to understand that the threat model for AI assistants isn’t keeping pace with how quickly they are adopted and deployed."／"Audit connector configurations: Review which apps are connected to Copilot and whether each connection is actively necessary. Fewer connections mean a smaller blast radius."／"Treat Copilot as a privileged insider: Apply the same access review and anomaly detection you would to a human employee with broad data access."／"Be cautious with links that open AI tools: If a link pre-fills a prompt, read what it says before it runs."／"Keep your connected apps minimal: Only connect services you actively use."／"The victim clicks the attacker’s crafted URL (delivered via email, chat, phishing page, QR code, etc.)"（How to protect your organization 節／QRコードの断片のみ Vulnerability 1: Automatic prompt execution 節）— Varonis Threat Labs より

"CoSnitch is three vulnerabilities, one click, and zero anomalous signals. Each vulnerability poses a serious risk on its own. Chained together, they turn a single click into a silent data-theft tool by exploiting the trust model at the heart of modern AI connectivity, not by breaking anything."／"The novel meta-hacking technique that uncovered CoSnitch — using the AI’s own reasoning to surface its hidden internals — applies to any agentic platform with a natural language interface."（The bottom line 節）— Varonis Threat Labs より