4 min read
News Brief Varonis researchers used the assistant's own refusals to map an undocumented URL parameter in Microsoft Copilot Personal, chaining it into silent access to Gmail, Drive, and Calendar. Microsoft patched CVE-2026-24301 on August 18.