CoSnitch Attack: Defending Microsoft 365 Copilot Against Prompt Injection and Architecture Reconnaissance

Security researchers have disclosed a novel attack technique dubbed CoSnitch that manipulates Microsoft 365 Copilot into revealing details about its own internal architecture, security controls, and backend infrastructure — a technique the researchers characterize as "meta-hacking." Rather than exploiting a traditional software flaw, CoSnitch weaponizes the very behaviors that make large language model (LLM) assistants useful: their willingness to reason, summarize, and answer questions about context they can access.

For defenders, this is a watershed moment. Copilot is embedded across Word, Excel, Teams, Outlook, and SharePoint in hundreds of thousands of enterprises, operating with the permissions of the signed-in user and, in some configurations, with broad tenant-level grounding data. An attacker — or a malicious insider — who can steer Copilot into enumerating its own system prompts, orchestration layers, plugin inventories, or internal service topology gains a reconnaissance advantage that previously required weeks of manual effort. Worse, the same prompt-injection primitives behind CoSnitch apply directly to data exfiltration: indirect prompt injection through malicious documents, emails, and Teams messages remains one of the most actively researched and demonstrated attack classes against M365 Copilot deployments.

There is no CVE assigned to this research, and Microsoft has characterized portions of the disclosed behavior as by-design LLM functionality. That framing should not comfort you. The absence of a patch means the defensive burden falls entirely on configuration, monitoring, and governance — exactly where most organizations are weakest right now.

Technical Analysis: How CoSnitch Works

Attack Model

CoSnitch is a prompt-engineering attack chain, not a memory-corruption or authentication-bypass vulnerability. Its mechanics, from a defender's perspective, break down as follows:

Direct meta-prompting. The attacker engages Copilot in a conversation designed to make the model reflect on itself — asking it to describe its instructions, enumerate its available tools and plugins, diagram the services it communicates with, or explain how it retrieves grounding data. Carefully chained prompts progressively peel back layers of the system prompt and orchestration metadata.
Indirect prompt injection (the higher-risk variant). The attacker embeds malicious instructions in content Copilot will later process — a SharePoint document, an email, a Teams message, or a webpage. When a victim user asks Copilot to summarize or act on that content, the embedded instructions execute in the victim's context, inheriting their permissions and data access. This is the delivery vector with real enterprise blast radius, because it requires no prior access to the tenant.
Exfiltration channel abuse. Prior Copilot research (and the class of attacks CoSnitch extends) has demonstrated that markdown image rendering, hyperlink construction, and citation mechanisms can be abused to smuggle data out of the conversation to attacker-controlled endpoints — encoding sensitive content into URL parameters that the client renders automatically.

Why This Is Hard to Fix

LLM prompt injection is not a bug with a patch; it is an emergent property of instruction-following models processing untrusted input in a trusted context. Microsoft's mitigations — spotlighting, prompt shields, content classifiers — reduce but do not eliminate the risk. Every custom Copilot Studio agent, every connected plugin, and every Graph-grounded data source expands the attack surface.

Affected Components

Microsoft 365 Copilot (all surface apps: Teams, Outlook, Word, Excel, PowerPoint)
Copilot Studio custom agents and declarative agents
Microsoft Graph connectors feeding Copilot grounding
Third-party plugins and message extensions invoked through Copilot

Exploitation Status

PoC status: Researchers have publicly demonstrated the technique against production Copilot.
In-the-wild exploitation: No confirmed widespread malicious campaigns attributed to CoSnitch specifically as of this writing; however, indirect prompt injection against LLM assistants is an active area of adversary tradecraft development, and the barrier to entry is effectively zero — no exploit code, just natural language.
CISA KEV: Not applicable (no CVE assigned).
Vendor response: Microsoft has applied layered mitigations (prompt shields, output filtering) and continues to treat this as an evolving defense-in-depth problem rather than a discrete patchable flaw.

Detection & Response

Detection of prompt-injection abuse is fundamentally a telemetry and behavioral analytics problem. The most valuable data source is the Microsoft Purview / unified audit log CopilotInteraction events, which capture prompts and responses when auditing is enabled. Below are detection artifacts built around the observable behaviors described above: meta-architecture probing, instruction-override phrasing, and exfiltration-shaped output.

Sigma Rules

These rules assume you are forwarding M365 unified audit logs (Purview) into your SIEM via a connector that maps to a standard schema — a common pattern with Sentinel's M365 connector or CEF/Syslog forwarding of audit records. Tune field names to your pipeline.

YAML

---
title: Copilot Meta-Prompting and Architecture Reconnaissance (CoSnitch Pattern)
id: 8f2c4a71-3b6d-4e19-9a72-c5d8e6f1a2b3
status: experimental
description: Detects prompt patterns consistent with attempts to coerce Microsoft 365 Copilot into revealing its system instructions, internal architecture, plugins, or backend services, as demonstrated by the CoSnitch research.
references:
  - https://www.darkreading.com/vulnerabilities-threats/cosnitch-attack-copilot-mapping-out-architecture
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.reconnaissance
  - attack.t1595
logsource:
  product: m365
  service: threat_intelligence
detection:
  selection:
    Operation: 'CopilotInteraction'
    Prompt|contains:
      - 'system prompt'
      - 'your instructions'
      - 'initial instructions'
      - 'what were you told'
      - 'ignore previous'
      - 'ignore all previous'
      - 'disregard your'
      - 'list your plugins'
      - 'available tools'
      - 'backend services'
      - 'internal architecture'
      - 'orchestration'
      - 'what APIs'
      - 'developer mode'
      - 'jailbreak'
  condition: selection
falsepositives:
  - Legitimate AI red team or security research activity within the tenant
  - Curious power users exploring Copilot capabilities
level: medium
---
title: Indirect Prompt Injection Indicators in M365 Content Processed by Copilot
id: 1e7b9d42-5a3f-4c28-8d61-b3a9f0e2c7d4
status: experimental
description: Detects documents or messages containing hidden instruction strings characteristic of indirect prompt injection payloads targeting LLM assistants, using metadata and content inspection fields surfaced in audit or DLP telemetry.
references:
  - https://www.darkreading.com/vulnerabilities-threats/cosnitch-attack-copilot-mapping-out-architecture
  - https://owasp.org/www-project-top-10-for-large-language-model-applications/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.initial_access
  - attack.t1566
logsource:
  product: m365
  service: data_loss_prevention
detection:
  selection:
    Content|contains:
      - 'ignore previous instructions'
      - 'ignore all previous instructions'
      - 'new instructions:'
      - 'assistant, you must'
      - 'do not tell the user'
      - 'system:'
      - '<|im_start|>'
      - '### instruction'
  condition: selection
falsepositives:
  - Security awareness training material
  - LLM development and testing documentation
level: high

KQL — Microsoft Sentinel Hunt

This query hunts the unified audit log for Copilot interactions containing reconnaissance or instruction-override language. The OfficeWorkload/Operation fields below match Sentinel's native OfficeActivity table schema for Copilot audit events. Deploy as an analytics rule with entity mapping on Account and suppress known red-team accounts via a watchlist.

KQL — Microsoft Sentinel / Defender

let SuspiciousPromptTerms = dynamic([
  "system prompt", "your instructions", "initial instructions",
  "ignore previous", "ignore all previous", "disregard your",
  "list your plugins", "available tools", "backend services",
  "internal architecture", "what APIs", "developer mode",
  "what were you told", "repeat the words above",
  "print your instructions", "orchestration layer"
]);
OfficeActivity
| where OfficeWorkload =~ "Copilot"
| where Operation =~ "CopilotInteraction"
| extend PromptText = tostring(parse_json(RecordType).CopilotEventData)
| where PromptText has_any (SuspiciousPromptTerms)
| summarize InteractionCount = count(),
            SamplePrompts = make_set(PromptText, 5),
            AppsUsed = make_set(tostring(parse_json(RecordType).CopilotEventData.AppHost), 10)
  by UserId, bin(TimeGenerated, 1h)
| where InteractionCount >= 3
| sort by InteractionCount desc

A companion hunt for potential exfiltration staging — Copilot responses containing unusual outbound URLs (the markdown-image exfiltration pattern) — is worth running weekly:

KQL — Microsoft Sentinel / Defender

OfficeActivity
| where OfficeWorkload =~ "Copilot"
| where Operation =~ "CopilotInteraction"
| extend ResponseText = tostring(parse_json(RecordType).CopilotEventData)
| where ResponseText matches regex @"!\[[^\]]*\]\(https?://[^)]+\?[^)]+\)"
| project TimeGenerated, UserId, ResponseText
| sort by TimeGenerated desc

Velociraptor VQL — Endpoint Artifact Hunt

Endpoint forensics is relevant where indirect prompt injection was delivered via a downloaded document or where you suspect a malicious Copilot Studio agent/plugin was installed. This artifact hunts for recently created Office documents containing embedded injection strings — useful when scoping a phishing-delivered payload.

VQL — Velociraptor

-- Hunt for documents containing indirect prompt-injection strings in user content directories
SELECT FullPath, Size, Mtime,
       read_file(filename=FullPath, length=4096) AS ContentSample
FROM glob(globs='C:/Users/*/Downloads/*.docx',
          accessor='ntfs')
WHERE Mtime > now() - 86400 * 14

In practice, .docx content is zipped XML, so pair this with the Windows.Forensics.Yara or Generic.Forensics.LocalFileSearch style hunts using a YARA rule matching ignore previous instructions, new instructions, and similar payloads against unpacked word/document.xml. The key forensic question is provenance: use Zone.Identifier alternate data streams and email gateway logs to trace delivery.

Remediation / Hardening Script

There is no patch to deploy. The meaningful controls are: restrict who can build and install Copilot Studio agents, disable unvetted plugins, and ensure Copilot audit events are flowing to your SIEM. This PowerShell validates and tightens the tenant posture.

PowerShell

# CoSnitch / Copilot prompt-injection hardening verification script
# Requires: ExchangeOnlineManagement, Microsoft.Graph modules with appropriate admin consent

# 1. Verify Purview audit logging is enabled (required for CopilotInteraction telemetry)
Connect-ExchangeOnline
$auditConfig = Get-OrganizationConfig | Select-Object -ExpandProperty AuditDisabled
if ($auditConfig -eq $true) {
    Write-Host '[!] Unified audit logging is DISABLED. Enable it: Set-OrganizationConfig -AuditDisabled $false' -ForegroundColor Red
} else {
    Write-Host '[OK] Unified audit logging is enabled.' -ForegroundColor Green
}

# 2. Confirm Copilot interaction events are searchable in the last 24h
$results = Search-UnifiedAuditLog -StartDate (Get-Date).AddDays(-1) -EndDate (Get-Date) `
    -Operations 'CopilotInteraction' -ResultSize 5
if ($results) {
    Write-Host "[OK] CopilotInteraction events present: $($results.Count) sample records found." -ForegroundColor Green
} else {
    Write-Host '[!] No CopilotInteraction events found. Verify Copilot usage and audit pipeline.' -ForegroundColor Yellow
}

# 3. Review which users can create custom Copilot Studio agents
Connect-MgGraph -Scopes 'Directory.Read.All','Application.Read.All'
Get-MgServicePrincipal -Filter "startswith(displayName,'Copilot Studio')" |
    Select-Object DisplayName, AppId, ServicePrincipalType |
    Format-Table -AutoSize
Write-Host 'Review app consent grants for Copilot Studio agents; remove unvetted publishers via Teams admin center and Power Platform DLP policies.' -ForegroundColor Cyan

# 4. Check Conditional Access coverage for M365 Copilot workload
$caPolicies = Get-MgIdentityConditionalAccessPolicy
$caPolicies | Where-Object { $_.State -eq 'enabled' } |
    Select-Object DisplayName, State | Format-Table -AutoSize
Write-Host 'Confirm at least one enabled CA policy targets Office 365 with MFA for all users.' -ForegroundColor Cyan

Remediation and Defensive Recommendations

Because there is no CVE and no patch, remediation is a governance-and-configuration exercise. Prioritize the following:

Enable and centralize Copilot auditing. Copilot interaction logging in Purview is the single most important detection prerequisite. Without CopilotInteraction events in your SIEM, you are blind to both CoSnitch-style probing and indirect injection outcomes. Verify retention meets your IR requirements (default is 180 days for Audit Standard; E5/Audit Premium extends this).
Constrain Copilot's data reach via oversharing remediation. Copilot only surfaces what users can already access — but most tenants have massive SharePoint/OneDrive oversharing. Run SharePoint Advanced Management (SAM) site access reviews and remediate "Everyone except external users" exposures before they become exfiltration-at-scale via a single injected prompt.
Lock down Copilot Studio and plugins. Restrict agent creation to a vetted maker group via Power Platform environment policies and DLP policies. Disable third-party and unvetted plugins in the Teams/M365 admin centers. Every connector is an injection and exfiltration surface.
Deploy Microsoft prompt shields and content filters where available. For organizations building on Azure OpenAI / Copilot Studio, enable prompt shields for both direct (jailbreak) and indirect (document-embedded) attacks. Test them — these filters reduce but do not eliminate risk.
Treat LLM output as untrusted content in downstream workflows. Any automation consuming Copilot/agent output (emails sent, tickets created, code committed) should apply the same validation you'd apply to user-submitted input. Prompt injection becomes consequential when output drives action.
Add AI-specific scenarios to your red team and purple team program. CoSnitch-style meta-prompting, indirect injection via email and documents, and exfiltration via markdown rendering should be standing test cases. If your internal red team isn't testing your Copilot deployment, external researchers — and eventually adversaries — will do it for you.
Monitor the vendor advisories. Track the Microsoft Security Response Center (msrc.microsoft.com), the M365 admin center message center, and Microsoft's guidance on Copilot data security and privacy. Given the pace of LLM-assistant research, expect additional disclosures in this class through 2026.

The strategic lesson from CoSnitch is one we've learned repeatedly in two decades of IR work: every new productivity surface is a new attack surface, and AI assistants collapse the reconnaissance phase from weeks to a single conversation. Organizations that treat Copilot governance as an afterthought are handing attackers an insider with a perfect memory and every user's permissions.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub