Artificial intelligence is eliminating security through obscurity, the long-standing cybersecurity assumption that most vulnerabilities remain unexploited simply because attackers lack the resources to find them.
Varonis Threat Labs demonstrated the shift by uncovering CoSnitch (CVE-2026-24301), a chain of three flaws within Copilot. Using a technique called meta-hacking, researchers prompted Copilot to explain its own security weaknesses through reframed questions. The exploit allows a single link to trigger auto-execution, covertly extract emails, calendar events and files via Copilot's connectors, and permanently poison its memory—all without triggering anomalous security signals.
This is Varonis's third Copilot vulnerability identified this year, each requiring only one click to initiate. The pattern reflects a harder truth: AI agents dramatically reduce the effort required to identify and exploit complex flaws.
For decades, the cybersecurity industry publicly acknowledged that "security by obscurity is not a real security strategy." Yet in practice, most organizations implicitly relied on obscurity working anyway. Vulnerabilities, misconfigurations and overly broad access paths went unexploited not because defenses were strong, but because attackers faced finite resources—personnel, infrastructure, attention.
Breaking into a company and achieving a malicious objective required significant investment in reconnaissance, investigation, prioritization, execution and persistence. This economic constraint meant truly targeted attacks were rare, even though they proved more successful and damaging than indiscriminate "spray and pray" methods.
AI agents and open-source models now provide attackers with capabilities that approximate unlimited resources for vulnerability discovery. The economic barrier that limited sophisticated attacks has erased.
AI vulnerability research can map input-reachable surfaces across entire codebases simultaneously, identifying logic bugs that static application security testing and manual penetration testing routinely miss. Enterprise software vendors—many running tens of millions of lines of legacy C and C++ code—now face a fully searchable attack surface. The cost of finding vulnerabilities has collapsed for malicious actors.
Security teams must shift from expecting obscurity to provide protection. The new model assumes vulnerabilities will be discovered and prioritizes robust, always-on defenses built for that reality.
