Microsoft Copilot Personal CoSnitch Vulnerability Exposed: One-Click Data Leak Chain Patched

Security research firm Varonis Threat Labs discovered CVE-2026-24301, codenamed CoSnitch, in Microsoft Copilot Personal. An attacker needs only a single click on a malicious link to make Copilot query and exfiltrate victims' Gmail, Google Drive, Calendar, and OneDrive data. Microsoft completed the patch on August 18, 2026.

What Happened

Varonis disclosed the vulnerability to Microsoft in December 2025, and Microsoft released the final patch on August 18, 2026. CoSnitch is the third Copilot-related vulnerability discovered by Varonis this year. Previously, Reprompt bypassed defenses through repeated questioning, while SearchLeak turned Microsoft 365 Copilot Enterprise into a silent exfiltration tool. All three incidents rely on the same pattern: a single click on a seemingly normal link by the user is enough to trigger them.

The researchers employed a meta-hacking approach, first asking Copilot how to execute prompts automatically. The system responded that user intent was required, but the researchers then pressed on about URL structure and page-loading details, ultimately getting the AI to expose its own internal parameters and weaknesses.

Mechanism Breakdown

CoSnitch relies on the chained exploitation of three weaknesses. Automated prompt execution is achieved through the ?q= URL parameter combined with undisclosed parameters, so when the page loads, the attacker-supplied prompt executes immediately without additional clicks or confirmation. Data exfiltration leverages Copilot's built-in URL fetching capability, encoding query results and sending them to a webhook controlled by the attacker. Persistent memory poisoning uses specially crafted webpage summaries to inject instructions into the victim's permanent memory storage; the injection persists even after password changes, session revocation, or device re-registration.

All these steps are carried out within the user's already-logged-in browser session. Copilot accesses connected applications with the permissions granted by the user, and no security alerts are triggered throughout the process.

Industry Impact

For enterprise users, once AI assistants are deeply integrated with email, calendars, and file storage, a single entry point becomes a potential data channel. Users need to review their Copilot connector settings and disconnect non-essential services to reduce their attack surface.

For developers, prompt injection protection needs to evolve from single-step validation to multi-layered validation, including URL parameter source inspection and memory write isolation. In existing AI workflow designs, user intent confirmation mechanisms are insufficient to block automated execution paths.

In terms of the competitive landscape, this incident shows that both the consumer-grade Copilot Personal and the enterprise-grade version face similar risks. Microsoft has fixed this specific attack chain, but other AI products operating under the same integration model face equal scrutiny pressure.

Strategic Assessment

Based on existing disclosures, security research institutions will continue testing automated execution and memory persistence features in other AI assistants to verify whether the patch covers all parameter combinations. Signals to watch include whether Varonis or other institutions release new vulnerability reports, and whether Microsoft updates its connector permission documentation.

Users can refer to Microsoft's support documentation on connector scope, regularly review authorized applications, and treat any link that opens an AI assistant with a pre-filled question as a potential risk source.