Researchers at Varonis disclosed CoSnitch, a flaw that made Microsoft Copilot exfiltrate data without tripping obvious alarms — reportedly the third such Copilot flaw this year. Any Cyprus business connecting AI assistants to its data should take note.
Our analysis
Three exfiltration flaws in one product, in one year, is a pattern, not bad luck. AI assistants wired into corporate data are a recurring, high-value target, and the stealth is the scary part: this isn’t the noisy data theft your DLP was built to catch. For Cyprus firms handling EU customer data, a silent AI-driven leak is still a GDPR incident.
What you should do
- Treat any AI assistant with data access as manipulable by untrusted content.
- Scope Copilot and agent permissions to the minimum data and actions needed.
- Monitor agent tool calls and outbound data flows, not just user prompts.
- Red-team AI deployments before launch and after each major change.
How CyprusPentest helps: our AI agent penetration testing and prompt injection testing probe these exfiltration paths.
Source: eSecurity Planet.