Researchers at Varonis disclosed CoSnitch, a flaw that let Microsoft Copilot “hack itself” and move data elsewhere without raising obvious red flags — reportedly the third critical exfiltration flaw found in Copilot this year.
When an AI agent can read sensitive content and take actions, attacker-controlled input becomes a control channel.
Our analysis
CoSnitch is part of a clear pattern: three Copilot exfiltration flaws in a single year is not a run of bad luck, it is evidence that AI assistants wired into corporate data are a durable, recurring attack surface. The most concerning trait is stealth — exfiltration that does not trip the usual DLP or produce “obvious red flags.” If your monitoring only watches humans, it will miss an agent quietly acting against you.
What you should do
- Treat every AI assistant with data access as a system that can be manipulated by untrusted content.
- Scope Copilot and agent permissions to the minimum data and actions genuinely required.
- Log and monitor agent tool calls and outbound data flows, not just the prompts users type.
- Red-team your AI deployments before launch and again after every major model or configuration change.
How AgentOffense helps: our AI agent penetration testing and prompt injection testing probe exactly these exfiltration and tool-abuse paths.
Source: eSecurity Planet.
How the exfiltration actually works
The attack needs no exploit code. An attacker plants instructions inside content the assistant will later read — a shared document, an email, a calendar invite. When a legitimate user asks the assistant a normal question, it retrieves that poisoned content and quietly follows the hidden instructions, packaging up sensitive data and sending it out through a channel the assistant is allowed to use.
This is indirect prompt injection, the hardest LLM risk to defend, explained in depth in prompt injection explained and how to secure an AI agent.
What this means for your business
When an AI assistant with access to your data can be tricked into leaking it, the breach needs no malware — just crafted content the assistant reads. Any Copilot-style integration that touches sensitive documents is now an exfiltration surface driven by indirect prompt injection.
How to reduce your exposure
- Treat every AI assistant with data access as an untrusted actor and scope its permissions tightly.
- Apply least-privilege to what the assistant can read and where its output can go.
- Monitor and log assistant actions and data access for anomalies.
- Test the assistant against indirect prompt injection before wide rollout.
Assess your AI deployment with prompt injection testing and AI agent penetration testing — get a fixed-price quote.