CoSnitch Flaws in Copilot Personal Could Enable One-Click Data Exfiltration
Summary
Varonis says CoSnitch flaws in Microsoft Copilot Personal could enable crafted links to run prompts in an authenticated session and exfiltrate data from connected apps. Microsoft patched CVE-2026-24301; researchers found no evidence of in-the-wild exploitation.
Key points
- Varonis Threat Labs disclosed three Copilot Personal flaws it collectively named CoSnitch, tracked as CVE-2026-24301.
- The researchers said combining the URL parameters autorun=1 and q could trigger an attacker-supplied prompt on page load in the victim’s authenticated session.
- The prompt could query services already authorized by the user and send retrieved data to an attacker-controlled webhook; the technique does not expand existing permissions.
- Testing reportedly exposed connected email content and metadata, calendar details, Google Drive file information, chat history, and saved Copilot memory.
- A separate web-summarization path could write attacker instructions to Copilot memory and, according to Varonis, persist until manually deleted.
- Microsoft shipped patches on August 18, 2026. Varonis said it found no evidence of exploitation in the wild and did not identify a client update users need to install.
- Varonis advised reviewing connected apps, disconnecting those not needed, monitoring access, and exercising caution with links that open AI assistants.
Article Details
- Vulnerability Types
- Automatic prompt execution via crafted URL parameters
- Data exfiltration from connected services
- Persistent memory poisoning through web summarization
- Exploitation Status
- not_reported
- Exploit Availability
- unknown
- Patch Status
- available
- Workarounds
- Review which apps are connected to Copilot and disconnect those not actively needed.
- Exercise caution with links that open AI assistants.
MITRE ATT&CK
T1132.001 · Standard EncodingThe described exfiltration can encode retrieved data using base64 before sending it in an outbound request.T1204.001 · Malicious LinkA victim's single click on a crafted link can open Copilot with attacker-supplied prompts that run automatically.T1567.004 · Exfiltration Over WebhookThe injected prompt can use Copilot's URL fetch to send retrieved data to an attacker-controlled webhook.
CVE
People
Gal ZrorCredited by Microsoft in its security blog for an MSRC case concerning the discussed class of attack.Håkon MåløyDocumented an attacker-controlled page that could persist unintended memory through a Microsoft 365 Copilot summarization flow.Johann RehbergerReported memory writes and deletions through indirect prompt injection in Microsoft 365 Copilot and memory modification in the consumer assistant.
Vendors
Products
Microsoft 365 CopilotThe research names Copilot Personal, the consumer assistant hosted at copilot.microsoft.com, and does not state that the same behavior affected Microsoft 365 Copilot.Microsoft Copilot PersonalVaronis Threat Labs disclosed CoSnitch, a set of three flaws in Microsoft Copilot Personal that could let a crafted link trigger silent prompt execution and exfiltrate data from connected apps in a victim’s