After nearly eight months since its discovery, Microsoft has addressed a significant vulnerability in its AI assistant, Copilot. This flaw, dubbed CoSnitch, was highlighted by Varonis and signifies escalating risks tied to AI integrations. The patch appears particularly crucial as it stems from Copilot's reliance on an LLM (Large Language Model) that struggles to correctly differentiate between data requests and execution commands.
Varonis initially uncovered the CoSnitch vulnerability—a troubling omen that encapsulates several Copilot flaws they identified earlier this year. These included the Reprompt vulnerability, which allowed bypassing security guardrails through repetitive queries, and SearchLeak, which transformed the software into an inadvertent data exfiltration mechanism. What’s alarming is the exploit pattern common to all three vulnerabilities: a mere click on a seemingly innocuous link can trigger significant security breaches.
Dissecting the CoSnitch Vulnerability
The recently released Varonis blog provided critical insights into how CoSnitch works. This vulnerability leverages three main issues inherent to Copilot:
- Automatic prompt execution: The use of a .?q= URL parameter, paired with an undocumented component, allows any injected prompt to execute immediately upon loading the page—no user interaction is needed.
- Data exfiltration to external servers: An attacker can call connected applications, such as Gmail or OneDrive, compile the information into a URL, and send it off to a webhook controlled by the attacker via Copilot's URL-fetch function.
- Persistent memory poisoning: If a crafted webpage is summarized by Copilot, it can embed attack instructions within the user's persistent memory, surviving even password updates, session terminations, or device changes.
One particularly noteworthy aspect of the CoSnitch flaw is its discovery process. Interestingly, Copilot inadvertently outlined its vulnerabilities during the investigation. As Varonis crafted prompts, Copilot disclosed crucial information about its architecture and security measures. This led to a successful exploit executed without any user consent.
The Vendor's Response
Following the patch’s release, Microsoft acknowledged the vulnerability while asserting that users do not need to take action, claiming their systems are now safeguarded. However, the company's assertion that enterprise clients using Microsoft 365 Copilot were unaffected sparked debate. Experts pointed out the complexity of enterprise environments, which might still include personal versions of Copilot used by employees, potentially exposing sensitive data across organizational boundaries.
As Microsoft pushes for a more integrated solution dubbed Copilot Fusion, this unification raises alarms about the continuity of vulnerabilities from its personal Copilot—underscoring a need for vigilance among enterprise security teams. Varonis initially identified the CoSnitch flaw on December 31, 2022, and although Microsoft acted to patch one aspect of the issue earlier, it took until now to offer a comprehensive solution.
According to Varonis’s senior security researcher, Lior Adar, the earlier patch significantly reduced risk, but it did not solve the problem entirely. The complexities presented by LLMs warrant ongoing scrutiny and adaptation in security strategies.
Implications for CISOs
The CoSnitch vulnerabilities serve as a wake-up call for security leaders. Mark Tauschek, a distinguished analyst, praised Varonis's method of coaxing Copilot into revealing its flaws, highlighting the sophistication of the hack involving social engineering amalgamated with prompt injection attacks. He likened the situation to the macro viruses that plagued digital security in previous decades and advised CISOs to consider disabling Copilot as a proactive defense measure, despite potential operational setbacks.
Aman Mahapatra, chief strategy officer of a New York technology consultancy, articulated a broader challenge at play—AI companies may find themselves in a predicament where security measures conflict with their business models. The features integral to Copilot's functionality are the very capabilities being exploited, complicating the patching process. He pointed out that these vulnerabilities exemplify a paradigm shift in security—not one where systems are fundamentally broken, but where the intents behind actions blur the lines between legitimate commands and malicious exploitation.
The Future of AI Security
The memory-poisoning aspect of CoSnitch has drawn particular concern, with its capacity to permanently embed instructions into Copilot's memory. Despite conventional incident response measures, the injected commands persist, operating within a context controlled by the attacker. According to experts, this persistent threat necessitates a reevaluation of AI architectures to better distinguish between harmless data and dangerous instructions—a challenge that remains largely unaddressed in current AI design.
As the AI field progresses, the implications of these vulnerabilities will only intensify. Flavio Villanustre, CISO at LexisNexis Risk Solutions, reinforced the idea that the inherent flaws present in LLMs create an unmistakable urgency for vendors to seek alternative architectures capable of providing enhanced safety measures. As AI integration becomes more prevalent, safeguarding these systems will be critical in preventing future compromises.
This article originally appeared on Computerworld.
