CVE-2026-24301 CoSnitch: Microsoft Copilot Personal One-Click Data Exfiltration, Publicly Disclosed by Varonis in August

Varonis discloses CoSnitch, a one-click data-exfil vulnerability in Copilot Personal, CVE-2026-24301, CVSS 8.8, patched August 18.

Varonis Threat Labs publicly disclosed a set of Copilot Personal vulnerabilities named CoSnitch on August 18, 2026. Primary issue: CVE-2026-24301, CVSS 8.8 (High). An attacker only needs to lure a victim already signed into Copilot Personal to click one malicious link, then silently read linked Gmail, Google Drive, Outlook, calendar, chat history, and Copilot long-term memory, exfiltrating data via legitimate URL fetch to an attacker-controlled webhook. Reported to Microsoft in December 2025; patched and published August 18, 2026.

Incident Overview

CoSnitch is the third one-click Copilot vulnerability Varonis Threat Labs disclosed in 2026: Reprompt bypassed Copilot defenses via follow-up questions; SearchLeak turned Microsoft 365 Copilot Enterprise into a silent exfil tool; CoSnitch targets consumer Copilot Personal (copilot.microsoft.com). Using a technique they call "meta-hacking," researchers repeatedly used natural-looking follow-ups to induce Copilot's reasoning engine to disclose a supposedly disabled URL parameter `autorun=1`, then combined it with the existing `q` parameter to build an attack URL that auto-executes an arbitrary prompt on page load. Microsoft's August 18, 2026 patch disabled/fixed the parameter and assigned CVE-2026-24301.

Technical Details

• CVSS v3.1: 8.8 / High; network attack vector, low complexity, no privileges required, one user click.

• Trigger: Copilot Personal URL routing layer and OAuth connectors (Gmail, Google Drive, Outlook, Calendar, Chat).

• Root cause: when `autorun=1` and `q` coexist in the URL, Copilot treats `q` as a full instruction and executes it immediately on page load. The prompt can query authorized connected services for email bodies, subjects, sender/recipient metadata, calendar titles and attendees, file metadata, chat history, and long-term memory, then base64-encode the data and send it via built-in URL fetch to an attacker-controlled webhook.

• Impact: after a single click, the prompt continues executing in the established session even if the victim immediately closes the Copilot tab. All readable content is within the victim's existing permissions, so DLP/CASB typically sees nothing.

• Third-class side effect: CoSnitch also disclosed an independent path—an attacker-crafted page, when summarized by Copilot, can inject persistent instructions into the user's long-term memory. Those instructions survive password changes, session revocation, and device re-registration.

• Preconditions: user is signed into a Copilot Personal session in the browser and clicks a malicious link containing `?q=...&autorun=1`.

Impact Assessment

CoSnitch breaks traditional defense assumptions for enterprise AI assistants:

• Legitimate APIs become attack channels: exfil requests look identical at the network layer to Copilot fetching ordinary pages; CASB/DLP struggle to identify them. Structural blind spots in traditional perimeter controls on AI-assistant paths.

• OAuth connectors amplify blast radius: one victim authorization of Gmail/Drive/Outlook lets the attacker pull mail, file metadata, and chat history across platforms. Multiple SaaS permissions concentrate at a single AI entry point.

• Long-term memory as persistence: injected instructions survive password changes and session revocation and remain effective in later conversations—a typical 2026 LLM application-layer "persistent residency" pattern.

• Attack model self-disclosed by the AI: Copilot described its own defenses and was then exploited—a landmark "meta-hacking" case. AI system design docs and dialogue logic themselves become exploitable intel.

Remediation

• Apply the August 18 patch: ensure Microsoft Copilot Personal client/server is current; watch MSRC follow-up on CVE-2026-24301.

• Audit OAuth connectors: re-authorize third-party connectors linked to Copilot Personal (Gmail, Drive, Outlook, Calendar, Slack/Teams, etc.) under least privilege; disable unnecessary connectors.

• Prompt-injection drills: add URL-triggered execution paths to red-team exercises; put prompt injection and OAuth permission drift on the AI system assessment checklist.

• CASB/DLP rules: add outbound traffic audit for Copilot Personal domains in CASB, with anomaly detection on base64 encoding patterns; extend DLP to AI-assistant traffic.

• User education: a single link can trigger silent data access in a signed-in AI-assistant session; report anomalous activity immediately.

• Memory audit: periodically clean suspicious instructions in Copilot Personal Memory settings to prevent long-term memory abuse.

References

• Varonis Threat Labs: CoSnitch technical deep-dive

• The Hacker News: three one-click Copilot Personal vulnerabilities

• MSRC: CVE-2026-24301 security update guide

• Aviatrix: CVE-2026-24301 attack-path analysis