Varonis
A data security company whose research arm, Varonis Threat Labs, has repeatedly found one-click flaws in AI assistants like Microsoft Copilot.
Varonis sells software that watches who can reach which files inside a company, and flags it when someone reaches for something they should not. That is the day job. The reason its name keeps showing up in AI coverage is its research arm, Varonis Threat Labs, which spends its time attacking the AI assistants that companies have wired into their email, storage and calendars.
In 2026 alone the team published three separate one-click flaws in Microsoft Copilot: Reprompt, SearchLeak and CoSnitch. All three followed the same shape, where clicking a normal-looking link is enough for an attacker to make the assistant read the victim’s own data and hand it over. Varonis reports findings to the vendor before publishing, which is why its posts usually arrive alongside a patch rather than ahead of one.