Varonis Threat Labs recently disclosed three vulnerabilities in Microsoft Copilot Personal that highlight a fundamental architectural problem: when an AI assistant has broad access to a user's connected applications, the assistant itself becomes a potential attack surface. The flaws, branded CoSnitch, expose how a single crafted link can silently exfiltrate data from any app or service the victim has authorised to Copilot.
The Attack Surface Inside Session Access
The core issue isn't exotic. It's permission scope. Copilot Personal integrates with multiple Microsoft services and third-party applications, which means it holds authorisation tokens and session context for those services. When a user clicks a malicious link—one that redirects through Copilot's own interface—the assistant processes the request within an authenticated session. The vulnerability leverages an undocumented URL parameter that Copilot itself surfaces, allowing an attacker to craft a request that extracts data without user awareness or consent.
For infrastructure and security teams, this pattern should feel familiar. It mirrors consent-confusion attacks, account-takeover chains, and privilege-escalation routes seen in other multi-tenant or multi-application environments. The difference here is that the trusted intermediary is an AI assistant, not a traditional API gateway or authentication broker.
Undocumented Parameters and Hidden Behaviours
The research revealed that Copilot was surfacing its own undocumented parameters in responses. This is particularly telling: when an AI system exposes interface details it wasn't intended to reveal, it creates a feedback loop where attackers can discover attack paths that the developers themselves may not have fully mapped. In traditional API security, undocumented endpoints are a red flag; they suggest incomplete threat modelling and testing.
The same principle applies here. If Copilot's own documentation doesn't cover how certain parameters behave, security teams can't audit the risk properly, and developers building integrations can't predict side effects. Varonis's disclosure shows that this gap is exploitable at scale.
Implications for Connected Application Architecture
Organisations deploying AI assistants as integration hubs—whether Copilot or alternatives—need to reconsider session and token scope. Best practice in traditional infrastructure is to compartmentalise privilege: a service should only hold access tokens for the specific resources it needs, and those tokens should expire quickly. AI assistants, by design, often need broad access to fulfil their purpose, but that breadth introduces risk.
Several design patterns can reduce exposure. Implement per-request token scoping, where Copilot requests a narrowly scoped token only for the immediate operation, rather than holding a long-lived session token. Use request signing or signed URLs so that parameters cannot be tampered with in transit. Audit and document every parameter Copilot accepts, including those that seem internal. And critically, enforce rate limiting and request logging so that anomalous data extraction attempts are visible to security monitoring.
A Reminder on Implicit Trust
The vulnerability also underscores a broader truth: clicking a link that redirects through a trusted tool is still clicking a link. Users who assume that Copilot will only execute requests they explicitly authorise may be caught off guard by silent data pulls. This isn't a user failure—it's a design failure. Assistants should require explicit consent before exfiltrating data, or at minimum, they should provide visible feedback when a request is being processed.
For teams operating hosting infrastructure or managing sensitive application ecosystems, the lesson is clear: integrating AI assistants into your stack demands the same rigorous security review you'd apply to any third-party service. Treat the assistant as a potential threat actor, not just a helpful tool. Define the minimum data it needs access to, implement monitoring around its API calls, and maintain an audit trail of what it retrieves.
The flaws were disclosed responsibly, and Microsoft has been engaged in remediation. But this incident is a marker of a larger challenge: as AI systems become more deeply woven into application workflows, the security model must evolve to match. Trust the assistant's intent, but verify its behaviour.
