Microsoft said Wednesday it has patched a critical vulnerability in its Copilot AI assistant, a flaw that security researchers first reported privately eight months ago. The bug, dubbed CoSnitch, could let an attacker trick Copilot into revealing its own architecture and sensitive data, and, in the worst case, turn the assistant into a tool for attacking the enterprise systems it is connected to.
The eight-month gap between the researchers’ report and the fix has unsettled the security community. The researchers who found the flaw published their findings after the patch, and their account of the timeline has become the subject of intense discussion among security professionals. The question being asked is not whether Microsoft fixed the bug, but why it took so long, and what that says about the security of AI assistants more broadly.
CoSnitch belongs to a growing family of attacks known as prompt injection. AI assistants are designed to follow instructions, and attackers have learned to smuggle malicious instructions into the text, images and documents the assistants process. The CoSnitch variant went further, using the assistant’s own capabilities against it: by manipulating what Copilot read, an attacker could make it reveal the internal workings of the model, extract information from the systems it had access to, or issue commands that harmed the organization running it.
The vulnerability was serious because of where it lived. Copilot is embedded in Microsoft’s most sensitive products, from coding tools to office software, and it is increasingly connected to corporate data. An assistant that can be tricked into revealing its own architecture is also an assistant that can be tricked into revealing the data it touches. For enterprises that have connected Copilot to their internal systems, the threat was not theoretical.
The delay has reignited a debate that has run through the industry since the first chatbots appeared: whether AI products are being deployed faster than they can be secured. Microsoft has made security a stated priority, and its chief executive has made a point of pressing the company to build security into its products. The CoSnitch timeline, critics say, shows the gap between the ambition and the practice.
Microsoft has defended its handling of the case. The company said the vulnerability was complex, that its researchers needed time to understand the full scope of the issue, and that the fix had to be tested across the many products that share Copilot’s infrastructure. The company also said the researchers’ report arrived as part of its coordinated disclosure process, and it has not said whether the flaw was exploited in the wild.
The episode is a test case for the industry’s handling of AI security. The traditional vulnerability process, in which researchers report flaws and companies fix them on a schedule, was built for conventional software. AI systems are different: they change constantly, their behavior depends on context, and a flaw in one model can resurface in another. The CoSnitch case suggests the old timeline does not fit the new technology.
The broader worry is that AI assistants are being granted access to more systems than their security can justify. Enterprises are connecting assistants to email, code repositories, customer databases and internal knowledge bases, drawn by the productivity gains. Each connection is a new surface for attacks like CoSnitch, and the pace of adoption has outrun the pace of hardening.
The researchers who found the flaw have said they hope the case will push Microsoft and other companies to invest more in testing AI systems before they ship. The industry has responded with a wave of new security products, from guardrails that filter what assistants can do to monitoring tools that watch for manipulation. Whether the defenses catch up is a question the next CoSnitch will answer.
The episode is already affecting buying decisions. Enterprises that rushed to deploy AI assistants are asking vendors harder questions about testing, and security teams are adding AI-specific review to their procurement processes. Consultants who advise companies on AI adoption said CoSnitch has become a case study in their training materials, taught alongside earlier generations of prompt-injection attacks. Some companies have also changed how they connect assistants to internal systems, limiting what the tools can read and do until the surrounding defenses mature.
For Microsoft, the episode shows the costs of scale. The company’s AI products are used by hundreds of millions of people and most of the world’s large companies, which means every flaw in them is a flaw in a system of enormous reach. The fix is out, the researchers have published, and the security community has moved on to the next question: how many similar flaws are still waiting, and how long they will take to fix. The eight months it took for CoSnitch will be the standard against which the next timeline is judged.
