Full Report
Varonis Threat Labs has disclosed three vulnerabilities in Microsoft Copilot Personal that it said could allow a single click on a crafted link to silently pull data from connected apps and other information available to the victim's Copilot session. The flaws, which the researchers collectively named CoSnitch, turn in part on an undocumented URL parameter that the assistant itself surfaced
Analysis Summary
# Vulnerability: CoSnitch - Microsoft Copilot Personal One-Click Data Exfiltration
## CVE Details
- **CVE ID:** CVE-2026-24301
- **CVSS Score:** Not explicitly listed in the article (Microsoft typically rates similar unauthorized data access flaws as **Important/High** severity).
- **CWE:** CWE-94 (Improper Control of Generation of Code / Instruction Injection) and CWE-20 (Improper Input Validation).
## Affected Systems
- **Products:** Microsoft Copilot Personal (Consumer version)
- **Versions:** Versions accessible via `copilot[.]microsoft[.]com` prior to August 18, 2026.
- **Configurations:** Systems where the user has authorized "Connected Apps" or "Connectors" (e.g., Microsoft Outlook, Google Drive, Calendar).
## Vulnerability Description
CoSnitch refers to a set of three vulnerabilities that allow an attacker to hijack a victim's Copilot session:
1. **Automatic Prompt Execution:** By leveraging an undocumented URL parameter (`autorun=1`) in conjunction with the standard query parameter (`q`), an attacker can force Copilot to execute an arbitrary prompt immediately upon the victim clicking a link.
2. **Exfiltration through Connected Services:** The injected prompt can instruct Copilot to query sensitive data from integrated services (emails, files, calendars), encode the data (e.g., Base64), and exfiltrate it to an attacker-controlled webhook using Copilot’s native URL fetch capabilities.
3. **Persistent Memory Poisoning:** A separate path allows a malicious webpage, when summarized by Copilot, to write persistent instructions into the user’s "Memory" store. These instructions survive session termination and password changes, influencing future AI responses.
## Exploitation
- **Status:** PoC available (demonstrated by Varonis Threat Labs); No evidence of exploitation in the wild.
- **Complexity:** Low (Requires only a crafted URL and social engineering).
- **Attack Vector:** Network (One-click via a malicious link or visiting a malicious webpage for summarization).
## Impact
- **Confidentiality:** **High** (Access to emails, chat history, calendar details, and cloud files).
- **Integrity:** **Medium** (Ability to "poison" Copilot's memory and alter the assistant's future behavior).
- **Availability:** **Low** (Service remains functional, though trust is compromised).
## Remediation
### Patches
- Microsoft released official patches on **August 18, 2026**. Users do not need to take manual action for the web-based assistant, as Microsoft has implemented the fixes server-side.
### Workarounds
- Revoke permissions for unnecessary "Connected Apps" within Copilot settings.
- Periodically clear Copilot's "Memory" or "Personalization" settings to remove potentially malicious persistent instructions.
- Exercise caution when clicking links that redirect to `copilot[.]microsoft[.]com` containing long or encoded query parameters.
## Detection
- **Indicators of Compromise:** Unusual outbound network traffic to unknown webhooks originating from Microsoft infrastructure (though difficult to distinguish from legitimate summarization tasks).
- **Detection Methods:** Users can review their Copilot "Memory" settings for any instructions they did not personally provide. Security teams should monitor for social engineering attempts involving links to Copilot with the `autorun` or `q` parameters.
## References
- **Vendor Advisory:** [https://msrc[.]microsoft[.]com/update-guide/vulnerability/CVE-2026-24301]
- **Researcher Report:** [https://www[.]varonis[.]com/blog/cosnitch]
- **Supplementary Info:** [https://thehackernews[.]com/2026/08/microsoft-copilot-personal-flaws-could[.]html]