Researchers successfully used a technique called "meta-hacking" to make Microsoft Copilot explain how to bypass its own security protections. In an experiment dubbed CoSnitch, the team repeatedly asked the model why it was impossible to create a URL that would automatically inject a prompt into Copilot and execute commands without user interaction.
By asking the model to explain the reasons for these restrictions, Copilot inadvertently revealed two parameters that, when combined in a specially crafted link, could execute malicious routines without victim confirmation. The exploit allowed attackers to access emails, Google Drive files, and conversation history, then exfiltrate the data to an external server.
Microsoft has since patched the vulnerability, assigning it the CVE identifier CVE-2026-24301. The discovery highlights how language models can sometimes be manipulated into revealing security details by asking them to justify their own limitations—a reminder that even AI safety measures require ongoing scrutiny and refinement.