A critical vulnerability in Microsoft Copilot Personal, tracked as CVE-2026-24301 and nicknamed CoSnitch, lets attackers silently siphon sensitive data from a victim’s connected accounts with nothing more than a single click on a malicious link.
The flaw discovered by Varonis Threat Labs has already been patched by Microsoft as of August 18, 2026, but the way it was discovered may be just as significant as the bug itself.
CoSnitch is the third Copilot vulnerability Varonis has uncovered this year, following Reprompt, which bypassed Copilot’s safety guardrails simply by asking a question twice, and SearchLeak, which turned Microsoft 365 Copilot Enterprise into a covert exfiltration channel.
All three exploits share a common thread: a single click on what looks like an ordinary link is all it takes to trigger the attack chain, with no obvious warning signs for the victim or their security team.
Microsoft Copilot CoSnitch Vulnerability
The vulnerability actually stemmed from three separate weaknesses working in sequence. First, an undocumented URL parameter, combined with Copilot’s standard “?q=” query parameter, allowed an attacker-crafted prompt to execute automatically the moment a victim’s browser loaded the page, without a click, keystroke, or confirmation of any kind.
Second, once that prompt fired, Copilot could query the victim’s linked apps, such as Gmail, Google Drive, and Calendar, and quietly funnel the retrieved data to an attacker-controlled server using Copilot’s own built-in URL-fetching feature.
Because the stolen data was base64-encoded and shipped out as a routine outbound web request, it looked identical to Copilot’s normal browsing activity, giving security tools nothing unusual to flag.
Third, and perhaps most concerning, a booby-trapped webpage could be summarized by Copilot in a way that injected hidden instructions directly into the assistant’s permanent memory. That poisoned memory persisted even through password changes, session revocations, and device re-enrollment, meaning standard incident response steps would not remove it.
What sets this discovery apart is the technique Varonis used to find it. Rather than reverse-engineering the code, researchers repeatedly questioned Copilot about why automatic execution “wasn’t possible,” reframing each of its refusals as a natural follow-up question.
Copilot’s own explanations, meant to demonstrate the exploit was infeasible, ended up mapping its internal architecture and ultimately revealing the exact undocumented parameter needed to pull it off. Varonis calls this approach meta-hacking, essentially social engineering the AI’s reasoning process rather than attacking its code directly.
Varonis reported CoSnitch to Microsoft in December 2025, and the company says it has found no evidence of active exploitation before the patch shipped.
Even so, the case underscores a broader problem: as AI copilots gain deeper access to enterprise email, files, calendars, and chat histories, a single compromised link can move large volumes of sensitive data through what looks like completely routine assistant behavior.
Security teams are being urged to audit which third-party apps remain connected to Copilot, treat the assistant as a privileged insider requiring the same access oversight as a human employee, and confirm their monitoring tools can actually detect anomalous data access originating from AI assistants, a blind spot many organizations may not realize they have.
Strengthen Your SOC by Accelerating Threat Detection & Rapid Investigations. -> Integrate ANY.RUN With Your SOC Now.
