CoSnitch Flaw Let a Single Click Turn Copilot Into a Data Exfil Tool

Microsoft Copilot’s job is to be helpful across every app you’ve connected it to. That same design turned out to be the problem. Varonis Threat Labs disclosed a vulnerability chain it calls CoSnitch, tracked as CVE-2026-24301, that let a single click on a crafted link quietly hand an attacker read access to a victim’s Gmail, Google Drive, and calendar through Copilot’s own connectors. Microsoft patched it on August 18, 2026, roughly eight months after Varonis first reported it privately.

A URL parameter Copilot wasn’t supposed to reveal

The way this bug got found is almost as interesting as the bug itself. Copilot Personal, the consumer version at copilot.microsoft.com, accepts a q= parameter in its URL to pre-fill a prompt. Normally a user still has to hit send. Varonis researchers wanted to know if there was a way around that, so instead of poking at the code directly, they just kept asking Copilot why automatic execution wasn’t possible.

Repeated enough times, the assistant’s own explanations started leaking implementation details it had no business sharing. Somewhere in the back-and-forth, Copilot referenced an undocumented parameter, autorun=1, that when paired with q= caused the prompt to fire the moment the page loaded, no click required. Researchers are calling the approach meta-hacking: rather than attacking the system, they socially engineered the model’s confidence in its own safety story until it explained the hole to them.

From auto-run to data theft

Getting a prompt to run silently is only step one. Once an attacker-controlled prompt executes inside a victim’s authenticated Copilot session, it inherits whatever OAuth permissions that user has already granted to connected services: mail, Drive, calendar, OneDrive, whatever’s hooked up. Varonis says its testing pulled full message bodies out of Gmail, including plaintext credentials sitting in old emails, along with Drive file contents and calendar entries.

Getting the stolen data out was the third piece. Copilot has a built-in URL-fetching capability meant for legitimate tasks like summarizing a webpage. The researchers found they could base64-encode exfiltrated content into a URL and have Copilot fetch that URL itself, sending the data straight to an attacker-controlled webhook disguised as routine outbound traffic. Nothing about the request pattern looked unusual to a defender watching normal Copilot activity.

The memory persistence angle makes it worse

The part that should worry security teams most isn’t the one-click trigger, it’s what happens after. Varonis found that a webpage Copilot is asked to summarize can carry hidden instructions, embedded in HTML comments or similar, that get written into Copilot’s cross-session memory as if the user had set them personally. That memory store persists. It survives a password reset, a session revocation, even re-enrolling the device. An attacker who plants instructions once doesn’t need the victim to click anything again.

That’s a meaningfully different threat model than a typical one-off exfiltration bug. Most credential theft ends when the victim changes their password. Here, the compromise lives in a place password resets don’t reach, which is exactly the kind of persistence that makes memory features in AI assistants worth extra scrutiny going forward.

Scope, patch status, and what to do

CoSnitch affects Microsoft Copilot Personal specifically, not Microsoft 365 Copilot’s enterprise tier, and Microsoft says there’s no evidence anyone exploited it before the August 18 patch. Varonis reported the issue in December 2025, giving Microsoft roughly eight months to fix it before public disclosure, a reasonably standard timeline for a bug of this severity.

If you or your organization use Copilot Personal with connected accounts, the patch should already be applied automatically since this is a hosted service rather than something users need to update themselves. It’s still worth reviewing what Copilot’s memory currently holds. Anyone who clicked an unfamiliar Copilot link in the past few months, especially one arriving via email, chat, or a QR code, should check their Copilot settings for instructions they didn’t set themselves and revoke connector access they don’t recognize.

The bigger lesson tracks with a pattern that keeps showing up across AI assistants this year: features designed for convenience, like memory that persists across sessions or built-in URL fetching, expand the blast radius of any prompt injection bug well past what a simple chat exchange would allow. Every new capability bolted onto an assistant is also a new thing an attacker can chain into.

References

• Varonis — CoSnitch: When Your AI Assistant Becomes Its Own Whistleblower
• The Hacker News — Microsoft Copilot Personal Flaws Could Let One-Click Attacks Exfiltrate Data From Connected Apps
• Cybersecurity News — Critical Microsoft Copilot CoSnitch Vulnerability Lets Attackers Steal Sensitive Data With One Click
• GBHackers — Critical Microsoft Copilot CoSnitch Flaw Lets Hackers Steal Sensitive Data With One Click