Copilot hack exposed via its own advice

Varonis Threat Labs exploited Microsoft 365 Copilot using the undocumented autorun=1 parameter, which auto-executes prompts from?q= URLs without user interaction. The researchers learned the technique by asking Copilot itself, naming the flaw CoSnitch and reporting it to Microsoft in December 2025.