Hubert Ramsey From August 18th to August 20th, three separate AI security research findings were made available. Microsoft fixed a flaw in Copilot that could empty your Gmail by means of a single link. A research lab released an attack which passes directly through safety filters by encrypting itself. And it was discovered that a sandbox library, which a large part of the AI agent industry relies on, had a vulnerability in its foundation.
There were three companies, three different levels in the stack, and three separate research teams who weren’t cooperating. When taken individually, they sounded like a poor week.
It isn’t a bad week; it’s the same issue appearing in three places, and after you notice it you can’t stop noticing it.
What actually happened
Copilot told researchers how to hack it
Varonis Threat Labs identified a series of flaws in Microsoft Copilot Personal, which has since been assigned the CVE number CVE-2026-24301 and goes by the name CoSnitch. The company released a patch on August 18.
The chain consists of three links. If an attacker’s prompt is to be executed, this happens because the undocumented URL parameter autorun=1 is used in conjunction with Copilot’s standard ?q= query parameter, so that the prompt runs as soon as the page is loaded and no click is required, no confirmation is needed, and there is nothing on the screen to indicate that anything has taken place.
It could then access anything that the victim had connected to—such as Gmail, Drive, Calendar, OneDrive, and the chat history of Copilot itself. The results would be packaged into a URL and sent out via Copilot’s built-in fetch function to a server that the attacker had control over. Varonis pointed out that the outgoing request appears exactly the same, at the network layer, as when Copilot is fetching a page that has been asked for a summary. Your security tools therefore see a normal AI assistant carrying out normal AI assistant activities.
The one that concerns you most is the third link. If a specially constructed web page is summarised by Copilot, then the attacker’s instructions could be stored in Copilot’s permanent memory—not in the session but in the memory. This kind of injection survives a change of password, it survives session revocation, and it endures even if the device is wiped and a new one is enrolled. It remains there until someone opens Copilot’s memory settings and deletes it manually, and during this time it produces no process, no file, and no log entry that would cause anything to raise an alarm.
As for how they discovered it, the researchers kept asking Copilot why their attacks weren’t working. Since it was helpful, Copilot provided an explanation. In giving this explanation, it revealed so much about its own architecture that the researchers were able to identify the undocumented parameter they had needed. Varonis refers to this as meta-hacking. It is a form of social engineering, but in this case the target is the model’s reasoning and not a person’s trust.
One other point worth knowing is that Varonis provided this information on December 31, 2025; Microsoft fixed part of it in February and the remainder on August 18. That amounts to almost eight months, and any memory poisoning that occurred during that period is still present in people’s accounts.
An attack that encrypts itself past the guardrails
Adversa AI has published a technique which they refer to as Cryptographic Context Injection, and the basic idea of it is almost annoyingly simple.
The safety guardrails read the text and classified it; they examined the words and decided whether these words described something harmful. That’s why Adversa stopped sending words and instead sent ciphertext, together with the key material and a instruction telling the model to decrypt it.
The guardrail encounters a piece of gibberish. It cannot classify this gibberish as dangerous since in order to recover the actual instruction you would have to run PBKDF2 and AES-256-GCM, and content classifiers do not carry out cryptographic functions. Therefore it allows it through. The model, on the other hand, does have a code execution sandbox, so it promptly decrypts the payload within its own environment and then carries out whatever it finds.
In the case of Grok, the entire chat history was leaked without the victim having to click anything. All the information that the guardrail would have needed to detect it was right there on the page. It was just not readable at the moment the check took place.
The timeline of this disclosure is in itself a separate matter. Adversa notified xAI on June 3, 2026, via the company’s HackerOne programme. xAI admitted it had received the notification but provided no further details and no timeline. Adversa made two more attempts, on August 4 and August 10, but received nothing in reply. On the 19th they published their findings, still being able to carry out the attack, and deliberately did not include the working payloads. The same method had been successful against Gemini in June, although its success rate had fallen considerably by August. Adversa did not know the reason for this, and Google never received a formal report since jailbreaks are not covered by its disclosure programme.
One of them is patched and the other one is a live zero-day while you are reading this.
The sandbox everyone builds on has a hole
On August 19 Endor Labs made public a serious vulnerability in isolated-vm, referring to it as GHSA-864f-rcv7-6rh4, even though a CVE has not yet been assigned.
You’re likely to have used a tool based on isolated-vm even if you’re not familiar with it. It is the Node.js library that enables untrusted JavaScript to run within a separate V8 isolate, and in reality this is the method by which a large proportion of AI agent platforms allow a model to execute code without the code having access to the host system. It receives about a million npm downloads each week.
The isolate itself remained unscathed. It was the C++ code responsible for passing values across the boundary that failed — specifically, there was a type confusion in the way ExternalCopy deals with the transferList option. As the researchers explained, they did not break the sandbox, rather they broke the code which carries data into it. Beginning with a single reference object, since this is the normal method by which a host grants a sandbox any capability, they progressed from causing a crash to taking over the host process’s control flow. This amounted to a complete escape from the guest to the host.
The versions up to and including 7.0.0 are affected, with patches released in 6.2.0 and 7.0.1.
The reason this case is different from a typical remote code execution vulnerability is that, in normal situations, an attacker has to find a means of getting to the vulnerable code. With an agent platform, the whole product functions as a machine that accepts code which can be influenced by an attacker and then runs it. There is no precondition to contend with since the execution of untrusted code is the feature.
The pattern
Examine precisely what went wrong in each instance.
Copilot treated the webpage as data and therefore regarded its contents as instructions. The guardrail treated the ciphertext as data and the model then converted it into instructions. isolated-vm accepted a value as data and this caused control flow to appear in the host process.
Same failure. Three altitudes.
Each of these systems lost sight of the line between ‘the stuff I am processing’ and ‘the stuff I am obeying’. Lior Adar from Varonis identified this as a fundamental architectural problem in LLMs, not as a flaw in a particular product.
Back in the old days, traditional software dealt with the problem in a painful way, mostly by chance. SQL injection is of the same kind: it involves user input entering the query. In the case of cross-site scripting, it’s also the same kind of thing: user input ends up on the page. These issues were resolved using parameterised queries and output encoding, since there is a real, structural distinction between code and data in a database query that can be enforced.
A language model does not have such a boundary; the system prompt, the user’s question, the webpage it has just retrieved, and the tool result it received all come in as tokens within the same context window. There is no syntactic indication to show which portion is authoritative and which is merely content; the model has to work out this distinction, and that inference is something that can be disputed.
That is precisely why such incidents continue to occur, and it is the reason why all the remedies hitherto employed have consisted of adding guardrails externally rather than making any actual structural changes. Adversa’s attack shows clearly what value there is in such an externally added guardrail: if you encrypt the payload then the classifier has nothing to classify.
Why the usual advice fails here
After a breach that is related to credentials, the usual course of action is to rotate the passwords, terminate the sessions, and re-enroll the devices. All of these measures have failed in the case of CoSnitch’s memory poisoning since the attacker’s instructions weren’t contained in a session or a credential; they were in the assistant’s memory of you.
It’s a completely new kind of issue. For years we’ve been teaching people that altering a password remedies an account compromise. That does not remedy this situation. Nothing in the usual incident response habits of most teams leads you to consider “checking the AI assistant’s stored memories”, and there is no log that tells you to do so.
The isolated-vm bug undermines a different assumption. Many AI platform architectures are based on one key premise: untrusted code can be used since it executes in a sandbox. The compliance argument, the risk evaluation, and the explanation for why no one has implemented a second layer all rest on this premise being valid. Once it is no longer valid, there is nothing left to support it, since the whole idea of the design was that no other measures were necessary.
If you use AI assistants
In practice, roughly in order of importance.
Check out the memories that your assistant has saved. Whether it’s in Copilot, ChatGPT, Gemini, or elsewhere, look at what’s actually stored there. If you come across anything that appears to be an instruction you never gave it, then remove it. All it takes is two minutes and almost no one has carried out this action.
Consider connected apps more carefully. The extent of the damage caused by CoSnitch depended completely on the apps that the victim had linked in. An assistant that has Gmail, Drive and Calendar connected is one who can read all three on behalf of the person who manages to send a prompt. Only connect the apps that you need and disconnect those that you had connected when you had finished a task in March. The same fundamental security practices that apply in all other areas also apply in this case.
Do doubt any link which opens an AI tool in the same way that you would doubt any other link; there is now a type of URL that loads a chat interface with a prompt already filled in.
Be suspicious of summaries. When you ask your assistant to summarise a page, you’re effectively feeding the contents of that page into your session. Generally, the pages are acceptable. The attack depends on the fact that some of them aren’t.
If you build with them
The mitigation advice issued by Adversa is the most useful thing that has been published this week and its recommendations apply very well beyond the particular attack they describe. Instead of attempting to detect malicious payloads, focus on provenance and tag the source of the content. Whenever a tool call is made whose arguments are derived from content that has been fetched or decrypted, block it. Set up alerts based on the entire sequence of actions rather than on any individual input, since that individual input is precisely what an attacker can make unreadable.
Regarding the sandbox issue, the obvious choice is to apply the patch to version 6.2.0 or 7.0.1. However, the more important lesson is that if your threat model includes the statement “contained by sandbox”, you should also include a second line. This isn’t since isolated-vm is undesirable — the researchers made it clear that it remains the best option currently available — but because a single control without any defence backing it up is still a single point of failure no matter how good it is.
The part that should bother you
The attackers did not discover any of these three. Both Varonis, Adversa and Endor Labs are defensive companies which have published their work.
That’s the positive point as well as the unpleasant one, since the pattern they’ve all brought to light can’t be fixed with a patch. Microsoft can remedy the autorun=1 issue; xAI will eventually be able to deal with encrypted prompts, and isolated-vm has released a version free from the type confusion. The fundamental problem — that these systems aren’t able to reliably distinguish content from commands — is a result of the way they’ve been built, not a flaw in the way they’ve been built this time.
We are proceeding at a rapid pace with integrating assistants into email, calendars, files and code execution, as if the boundary problem had already been resolved. It has not; instead, it is being handled on a case-by-case basis by researchers who reach the situation first.
This week they did so. That has some value, and it doesn’t amount to being safe.
Sources
- Varonis Threat Labs — CoSnitch: When Your AI Assistant Becomes Its Own Whistleblower
- Adversa AI — Cryptographic Context Injection
- Endor Labs — GHSA-864f-rcv7-6rh4 in isolated-vm
- The Hacker News — Microsoft Copilot Personal flaws and isolated-vm sandbox escape
- SecurityWeek — Encrypted prompts bypass AI safety guardrails
- Dark Reading — CoSnitch attack analysis
- OWASP GenAI Security Project — LLM01: Prompt Injection, the standard taxonomy for this class of flaw
Chief Editor 
