.png)
Microsoft has patched three chained flaws in Copilot Personal that let a single crafted link silently pull data out of a victim's connected apps and plant persistent, cross-session memory into the AI assistant. The bug chain, disclosed on August 18, 2026 by Varonis Threat Labs under the name CoSnitch, is tracked as CVE-2026-24301 in Microsoft's Security Update Guide.
How CoSnitch works
The core primitive is an undocumented URL parameter, autorun=1, that Copilot itself surfaced to researchers during a technique Varonis calls "meta-hacking" — repeatedly asking the assistant why a prompt could not fire automatically and using each refusal to narrow the attack surface. Paired with the existing ?q= query parameter, it causes an attacker-supplied prompt to execute on page load inside the victim's authenticated copilot.microsoft.com session, with no click, confirmation or gesture required. The prompt keeps running even if the tab is closed.
Once execution starts, the prompt runs with the same rights as an instruction the user typed. Varonis' testing pulled full message bodies and metadata from connected Gmail and Outlook accounts, meeting titles, attendees, times and locations from Google Calendar, file names and metadata from Google Drive, prior conversation content from Copilot's chat history, and the saved instructions inside Copilot's memory store.
The three flaws, chained
Varonis grouped the findings into three vulnerabilities. The first, automatic prompt execution, forces Copilot to run a URL-supplied prompt on load. The second, exfiltration through connected services, base64-encodes retrieved data and pushes it to an attacker-controlled webhook via Copilot's built-in URL-fetch capability — a request that looks identical at the network layer to any ordinary summarization fetch. The third is a separate memory-poisoning path: a maliciously crafted webpage, when summarized by Copilot, writes attacker instructions into the user's permanent memory store, where they survive password changes, session revocation and even device re-enrollment.
Microsoft's fix and what remains
Varonis reported the flaws to Microsoft in December 2025 and said patches shipped on August 18, 2026. Microsoft's Security Update Guide names the primary bug CVE-2026-24301. Varonis said it has seen no evidence CoSnitch was exploited in the wild and that no client-side update is required from users. The disclosure does not, however, state whether Microsoft's remediation retroactively removes memory entries planted before the fix; injected memories persist until users manually delete them from Copilot settings.
CoSnitch is the third Copilot flaw Varonis Threat Labs has published this year, following the January "Reprompt" guardrail bypass and June's "SearchLeak" against Microsoft 365 Copilot Enterprise. The disclosure lands less than two weeks after the same team detailed RovoBlast, a similar one-click attack on Atlassian's Rovo assistant that abused the rovoChatPrompt URL parameter.
What defenders should do now
Varonis' guidance for security teams is to audit which apps are connected to Copilot and trim any that are not actively needed, treat the assistant as a privileged insider for access review and anomaly detection, and add scrutiny for links that open AI assistants — especially from external senders. The company also recommends verifying that monitoring tools can detect unusual data access patterns originating from Copilot, a common blind spot given that connector-driven fetches use the user's own permissions.
See our related coverage of Anthropic's Frontier Red Team findings on rogue Claude agents, CISA's earlier KEV additions covering Langflow, Tomcat and N-central and the Ray CVE-2025-62593 addition targeting AI dev environments.
Reporting based on coverage from Varonis Threat Labs' CoSnitch disclosure, The Hacker News and Microsoft's Security Update Guide advisory for CVE-2026-24301.