Microsoft Addresses Persistent Copilot Vulnerability, But Challenges Remain for Security Teams

Microsoft has finally rolled out a patch for a serious security flaw in its Copilot AI assistant, an issue it confirmed nearly eight months ago. The vulnerability, named CoSnitch by cybersecurity company Varonis, exploits the assistant's reliance on large language models (LLMs), which struggle to differentiate between data and instructions in user queries.

This vulnerability is the third reported by Varonis this year, following the previously discovered Reprompt and SearchLeak bugs. Both these issues highlighted how easy it can be to bypass Copilot's protective measures, with the common theme being that even a single click on a seemingly legitimate link can enable exploitation.

Varonis detailed the nature of the CoSnitch vulnerability in a blog post, emphasizing the multiple layers through which it operates. According to the firm, CoSnitch is built on three main exploits:

• Automatic prompt execution: This flaw allows any prompt supplied by an attacker to execute immediately upon page load without requiring any user action — merely clicking a link suffices.
• Data exfiltration: Once executed, a malicious prompt can extract sensitive information from connected apps like Gmail and OneDrive, sending the data to an attacker-controlled server using Copilot's embedded URL-fetching capabilities.
• Persistent memory poison: A webpage that is summarized by Copilot can infect the assistant's memory with malicious instructions that survive across account changes or device re-enrollments.

Understanding the Discovery Process

The method Varonis used to uncover the CoSnitch vulnerability is particularly noteworthy. The researchers engaged with Copilot, which, in an attempt to justify its defenses, inadvertently disclosed information about undocumented URL parameters and other vulnerabilities. This interaction effectively led to the unintended execution of an attack.

Varonis described this interaction as tricking Copilot into revealing its weaknesses, showcasing the critical architectural flaws in how such AI systems are designed. Microsoft has acknowledged the flaw and provided a patch, asserting that customers are protected without the need for action on their part.

However, Microsoft’s reassurance came with a caveat: while it claimed that enterprise customers using Microsoft 365 Copilot aren't affected, the reality is that personal versions of Copilot can exist within many enterprise environments, complicating the security landscape for organizations.

Moreover, the timeline for addressing the CoSnitch vulnerability raises questions. Varonis initially flagged the issue in December, with a partial fix implemented by February. The complete resolution took another several months, emphasizing the persistent struggle tech companies face between responding to security threats and maintaining feature sets that attract users.

Implications for Enterprise Security

For Chief Information Security Officers (CISOs), the implications of this vulnerability are substantial. Mark Tauschek of Info-Tech Research Group argues that the findings mark a return to a proactive stance, reminiscent of past issues encountered with macro viruses. He suggests that it might be necessary to disable Copilot in some environments until sufficient safeguards are definitively in place.

Aman Mahapatra, chief strategy officer at Tribeca Softtech, elaborates on the inherent conflict in addressing security flaws within AI products. The functionality that creates vulnerabilities also drives the value proposition for these tools, complicating efforts to implement strict security measures.

As cybersecurity experts like Flavio Villanustre note, the CoSnitch vulnerability showcases a fundamental issue with LLMs currently in use: their incapacity to distinguish between harmful instructions embedded within normal data streams. This concern emphasizes the need for a fundamental shift in the architectural framework of these systems to enhance overall security.

Given that the mechanisms allowing these vulnerabilities exist intrinsically within how Copilot operates, experts agree that vigilance is necessary. While mitigating strategies can reduce risks, they can't eliminate them entirely. The CoSnitch vulnerability serves as a stark reminder of the evolving risks associated with AI technologies and the need for continuous security enhancements.

This article originally appeared on Computerworld.