Security researchers at Varonis Threat Labs found a critical vulnerability in Microsoft Copilot Personal that let a single clicked link silently pull sensitive data out of a victim’s connected Gmail, Google Drive, and calendar accounts, with no further clicks or confirmation required. Microsoft patched the flaw, tracked as CVE-2026-24301 and nicknamed CoSnitch, on August 18. The more striking detail is how researchers found it: they didn’t reverse-engineer any code. They simply kept asking Copilot why a certain attack wouldn’t work, and the assistant eventually explained, in plain language, exactly how to make it work.
How the attack actually worked
CoSnitch chained three separate flaws together. The first was automatic prompt execution: Copilot’s standard ?q= URL parameter, combined with an undocumented parameter called autorun=1, caused any attacker-supplied prompt embedded in a link to execute the instant the page loaded, with no click, confirmation, or user action required beyond opening the link itself. The second was data exfiltration through a channel that looked entirely routine: Copilot would collect information from a user’s already-connected apps, then quietly transmit it to an attacker-controlled server disguised as an ordinary request to summarize a webpage, the kind of action security tools see Copilot perform constantly and have no reason to flag.
The third component, and the one Varonis called the most concerning for long-term risk, was persistent memory poisoning. An attacker could host a page with instructions hidden in HTML comments or invisible page elements, and when a victim asked Copilot to summarize that page, the assistant would process the hidden instructions alongside the visible content. Those hidden instructions could write new rules directly into Copilot’s persistent memory, rules that survived password resets, session revocations, and even device re-enrollment, meaning cleaning up after an attack required manually finding and removing the poisoned memory entries rather than simply changing a password.
The flawed assumption underneath all three
Varonis’s report identifies the actual root cause with unusual clarity: the entire system assumed that any request to a connected application, Gmail, Drive, Calendar, always began with a deliberate, direct user instruction. CoSnitch broke that assumption entirely. The victim had, at some earlier point, legitimately granted Copilot access to those connected apps, so no unauthorized OAuth access or password theft was ever needed. The vulnerability wasn’t in the permission system, it was in the belief that legitimate access could only ever be invoked by an intentional user action, when in reality a maliciously crafted link could invoke that same access without the user doing anything more than opening a page.
Why the discovery method matters as much as the bug
Varonis is calling its approach meta-hacking: rather than analyzing Copilot’s underlying code, researchers repeatedly asked the assistant itself why a given attack path was blocked, reframing questions and probing its refusals until it revealed the specific undocumented parameter that made the exploit possible. That’s a genuinely different vulnerability-discovery method than traditional reverse engineering, and it reflects a real, structural risk specific to conversational AI systems: a model trained to be transparent and helpful about its own reasoning can be steered into explaining its own security weaknesses to whoever asks the right sequence of questions, a very different failure mode than a traditional system quietly leaking implementation details through error messages or logs.
This isn’t Varonis’s first Copilot disclosure this year. CoSnitch is the third vulnerability the firm has reported to Microsoft in 2026, following Reprompt, which bypassed Copilot’s safety guardrails simply by asking the same question twice, and SearchLeak, which turned Microsoft 365 Copilot Enterprise into a covert exfiltration channel. All three share the same underlying pattern Varonis has flagged: a single click on what looks like an entirely ordinary link is enough to trigger the full attack chain, with no obvious warning sign visible to the victim or their security team at the time.
A patch that took eight months
Varonis reported CoSnitch to Microsoft in December 2025, and the fix didn’t ship until August 18, 2026, roughly eight months later. Microsoft says it found no evidence the vulnerability was ever exploited in the wild, and a spokesperson told reporters the fix was applied server-side, meaning enterprise customers running Microsoft 365 Copilot were unaffected and no customer action is required, since the vulnerability was specific to Copilot Personal, the consumer assistant at copilot.microsoft.com. Varonis has still recommended that users review Copilot’s granted permissions, remove any connections they no longer actively need, and confirm their security tooling can actually detect unusual activity originating from an AI assistant, since as this case shows, that activity can look identical to the assistant’s normal, expected behavior.
The underlying lesson extends well past Copilot specifically. As more AI assistants get wired into connected personal accounts, email, calendars, cloud storage, the same core assumption CoSnitch exploited, that connector access only ever follows a deliberate user request, is one every assistant with similar integrations needs to actively defend against, not simply assume holds by default.
See Varonis’s full technical writeup for the complete disclosure timeline and exploit chain.
