URL Parameter Prompt Injection: How Deep Links Poison AI Agent Memory and OAuth-Connected State

URL parameter prompt injection is SSA descriptive wording for prompt injection delivered through a link's own query string rather than typed chat input, a retrieved document, or a tool call's return value: an attacker crafts a URL whose parameters pre-fill, and in the worst documented case automatically run, a prompt the agent treats as legitimate input the moment the link opens. Two 2026 vendor disclosures show the resulting compromise can reach past the session that triggered it: Varonis's CoSnitch finding against Microsoft Copilot Personal (CVE-2026-24301) chained an undocumented autorun parameter into a durable memory write that outlived a password reset, a session revocation, and a device re-enrollment, and Oasis Security's Claudy Day finding against Claude.ai chained a hidden-HTML URL parameter into an Anthropic Files API exfiltration channel.

What it is

The defining object is state the agent writes or reaches as a direct consequence of a link being opened rather than a message being typed: a durable memory record, a connected account's data, or an uploaded file. The defining cause is a query-string parameter, commonly one already used to pre-fill a shared or bookmarked query, carrying attacker-controlled instruction text, sometimes visible and sometimes hidden inside invisible HTML tags the chat interface renders but a person does not see. The defining consequence is that the model processes that text as though the user had typed or approved it, because the feature's whole purpose is to make a pre-filled query feel seamless. Two variants exist in the documented cases: parameter-driven autorun removes the one human gesture left, the click that sends a pre-filled box, so the prompt runs on page load with no confirmation at all; parameter-driven concealment leaves that click in place but hides part of the payload from the person making it, so the remaining gesture never actually reviews what gets executed.

What it is not

• Agentic browser session hijacking, where the instruction arrives in a page the agent navigates to mid-task, not in the URL that opened the chat session.
• A phishing technique abusing how a chat interface renders untrusted Markdown links or images from a page summary, rather than a query parameter in the opening link.
• A documented deep-link feature working as designed: a pre-filled query a user reads and deliberately sends is not in scope. The failure is a parameter that skips that review, by auto-running or by hiding part of the payload from it.
• Persistent memory injection through a document, image, or ordinary tool result, the broader entry path this attack's memory-poisoning consequence is a documented special case of.
• Reproducible payload markup or a construction guide for an invisible-HTML or autorun URL.

Target state, trust boundary, and persistence

The target state is whatever the agent reaches once the link-supplied prompt runs: a durable memory record written through the agent's own memory API, or data pulled through already-authorized OAuth connectors or an account-scoped upload API, in the documented cases. The trust boundary that fails is the assumption that content inside the product's own URL carries the same trust as something the user typed; a pre-fill parameter exists so a bookmark or shared link can supply a query without retyping it, which means its whole purpose is to be treated as user-authored text. CoSnitch and Claudy Day both show that purpose becoming the vulnerability once a second step, an autorun flag or an invisible tag, defeats the one safeguard the feature otherwise relied on.

Persistence differs by variant. CoSnitch's memory-poisoning record stayed active, per Varonis, through a password change, a session revocation, and a device re-enrollment, because the memory store it wrote to carries no expiration and is checked by none of the standard account-recovery steps, a materially longer window than a cookie compromise credential rotation does clear. Claudy Day's exfiltration channel and open redirect instead stay usable only for as long as the crafted link remains live and undiscovered.

What the research establishes

Varonis Threat Labs disclosed CoSnitch, tracked as CVE-2026-24301, against Microsoft Copilot Personal, reporting it to Microsoft in December 2025 and confirming a patch shipped August 18, 2026. Researchers found the flaw via meta-hacking: repeatedly asking Copilot why a bypass of its own auto-execution safeguards would not work, until its answers disclosed an undocumented parameter. As they put it, "you don't exploit the model, you manipulate it into cooperating." The chain combined a crafted ?q=<prompt>&autorun=1 link needing no confirmation gesture, a step querying connected Gmail, Calendar, and Drive accounts and moving results out through Copilot's own URL-fetch tool disguised as routine summarization, and a step triggered by asking Copilot to summarize an attacker's page that wrote attacker-chosen text into its persistent memory. Varonis summarized it as "three vulnerabilities, one click, and zero anomalous signals," with no evidence of in-the-wild exploitation before the patch (Varonis, CoSnitch); Sri Lanka's national CERT republished the advisory (CERT-NCSOC-0249).

Oasis Security disclosed a structurally similar, independently discovered chain against Claude.ai on 2026-03-18, updated 2026-05-27, naming it Claudy Day. A claude.ai/new?q= link carrying invisible HTML tags let an attacker add instructions a user could not see in the pre-filled chat box but that Claude still processed once the visible message was sent. Oasis chained that into an Anthropic Files API flaw, where a key embedded in the hidden prompt caused Claude to search the session for sensitive content and upload it to the attacker's own account with no external webhook, plus an open redirect at claude.com/redirect/<target> laundering the link behind a legitimate-looking domain. Anthropic fixed the parameter issue; the redirect and Files API channel were still being mitigated as of Oasis's writeup (Oasis Security, Claudy Day). Two independent findings against two vendors, each pairing a query-parameter injection step with a distinct second-stage effect, is evidence of a pattern in how deep-link features get built, not one product's isolated bug.

Detection: observable signs

• A chat session's first turn originates from a URL navigation carrying a pre-fill parameter rather than the user's own typed message.
• A memory-write, file-upload, or connector-query tool call occurs in that same opening turn, before the user has typed anything.
• The rendered text of a pre-filled query does not match the raw query-string parameter byte for byte, suggesting hidden content riding alongside it.
• A memory record or connector grant stays active across a password reset, token revocation, or device re-enrollment expected to clear session-scoped compromise.

Defenses, containment, and recovery

The table below is SSA editorial guidance for defenders, not a standard requirement or effectiveness ranking.

Prevention should treat every URL-sourced parameter as untrusted content, not a trusted feature, and close the gap between what a confirmation step shows and what the model receives. Detection should flag memory, file, or connector activity in a session's earliest turns. Containment should revoke the specific memory record or connector grant implicated, not assume a password reset accomplishes that. Recovery should audit every such grant created in a link-originated session regardless of later credential rotation.

Boundaries with similar concepts

This differs from agentic browser session hijacking in where the content enters: that entry's attacks ride in a page read mid-task inside an already-open session, while this one rides in the URL that opens the session. It differs from persistent memory injection in entry path only: that broader term covers any untrusted content causing a memory-write call, and CoSnitch's memory-poisoning step is a documented instance of the same consequence reached through a URL parameter instead.

Mapping to standards and research

Related terms

• Agent state attack: the umbrella definition.
• Persistent memory injection: the broader entry path for any content-triggered memory-write call.
• Agentic browser session hijacking: the adjacent entry path for content read mid-browsing.
• MCP confused deputy and token passthrough: an adjacent OAuth attack with a protocol-level, not link-delivered, cause.

FAQ

Does disabling deep links fix this?

It removes the entry path at the cost of a feature many products rely on for shared and bookmarked queries. Neither documented fix required removing it: Microsoft patched the undocumented autorun parameter, not the pre-fill parameter itself, and Anthropic patched the invisible-HTML handling, not the pre-fill feature.

Does resetting a password clear this kind of compromise?

Not reliably. Varonis confirmed a memory record written through this entry path survived a password change, a session revocation, and a device re-enrollment, because none of those steps touch a memory store with no expiration policy of its own. Recovery needs to audit the specific record or grant directly.

Sources

• Varonis, CoSnitch: When Your AI Assistant Becomes Its Own Whistleblower
• CERT-NCSOC-0249, Microsoft Copilot Personal One-Click Data Exfiltration Vulnerability (2026-08-19)
• Oasis Security, Claudy Day: Chaining Prompt Injection and Data Exfiltration in Claude.ai (2026-03-18, updated 2026-05-27)
• OWASP Top 10 for Agentic Applications 2026 (Version 2026, December 2025)
• MITRE ATLAS
• MITRE ATLAS data release v2026.06 (2026-06-30)
• MITRE, CWE-352: Cross-Site Request Forgery
• MITRE, CWE-451: User Interface (UI) Misrepresentation of Critical Information

Verification and change history

Standards and versions referenced: OWASP Top 10 for Agentic Applications, Version 2026 (December 2025); MITRE ATLAS, data release v2026.06 (2026-06-30); CWE-352; CWE-451.

Last verified: 2026-10-02. The Varonis CoSnitch findings, the CERT-NCSOC advisory, and the Oasis Security Claudy Day findings were read from the sources' own pages on this date. The OWASP and MITRE identifiers were reused from this site's previously verified crosswalk entries.

Change history: 2026-10-02, first version.

Working-term label: Mixed provenance. "CoSnitch" and its CVE number are a Varonis Threat Labs research/industry term. "Claudy Day" is an Oasis Security research/industry term. ASI06:2026 and ASI03:2026 are OWASP Standard Terms. AML.T0051.001, AML.T0080.000, and AML.T0086 are MITRE ATLAS Standard Terms. CWE-352 and CWE-451 are MITRE Standard Terms. "URL parameter prompt injection" as the umbrella covering both documented variants is SSA descriptive wording, not a standard term.