Microsoft Copilot Personal Flaws Enable One-Click Data Exfiltration via CoSnitch

Varonis Threat Labs has disclosed three vulnerabilities in Microsoft Copilot Personal, collectively named CoSnitch, that could allow a single click on a crafted link to silently exfiltrate data from connected apps and other information available to the victim’s Copilot session. The flaws, tracked as CVE-2026-24301, were reported to Microsoft in December 2025, with patches shipped on August 18, 2026.

The research focuses on Copilot Personal, the consumer assistant hosted at copilot.microsoft.com, and does not state that the same behavior affected Microsoft 365 Copilot. The researchers found no evidence that CoSnitch was exploited in the wild. They discovered the vulnerabilities through a technique they call ‘meta-hacking,’ repeatedly asking Copilot why a prompt could not be made to run without user interaction. The assistant eventually revealed an undocumented URL parameter, autorun=1, which, when combined with the existing q parameter, allows an attacker-supplied prompt to execute automatically on page load within the victim’s authenticated session.

The three vulnerabilities include: automatic prompt execution, exfiltration through connected services, and persistent memory writes from summarized pages. The exfiltration path can query services the user has already authorized, encode retrieved data, and use Copilot’s built-in URL fetch to send it to an attacker-controlled webhook. The memory-poisoning path, triggered through web summarization, can write attacker instructions into the user’s memory store, where they persist across password changes and session revocations, and are not flagged by security tooling.

Varonis advised users to review connected apps, treat Copilot as a privileged insider, and exercise caution with links that open AI assistants. The disclosure comes less than two weeks after the same team detailed RovoBlast, a similar one-click attack on Atlassian’s Rovo assistant.