CoSnitch: When Your AI Assistant Becomes Its Own Whistleblower (CVE-2026-24301)

What it is

CoSnitch (CVE-2026-24301, critical) is a one-click data-exfiltration chain in Microsoft Copilot Personal, disclosed by Varonis Threat Labs. Varonis disclosed it to Microsoft in December 2025; patches shipped August 18, 2026. It is the third Copilot flaw Varonis reported this year, after Reprompt and SearchLeak — all sharing the "one click on a legitimate-looking link" pattern. Varonis reports no in-the-wild exploitation. The novel angle the summary misses: the flaw was found via "meta-hacking" — Copilot disclosed its own undocumented parameters and disabled protections while explaining why an attack "wouldn't work."

How it works

The chain combines three distinct vulnerabilities:

1. Automatic prompt execution. The attack URL is https://copilot.microsoft.com/?q=<malicious_prompt>&autorun=1. ?q= alone only pre-fills the input (user must press Enter); it is ?autorun=1 that fires the prompt on page load — no click, no confirmation. Both parameters are required. Copilot processes the injected prompt in the victim's active authenticated session, with full access to session context, connected apps, and memory. Execution completes even if the tab is closed immediately after load.
2. Data exfiltration to external servers. An injected prompt queries connected apps (Gmail, Drive, Calendar, OneDrive), encodes results into a URL, and exfiltrates via Copilot's built-in URL-fetch to an attacker webhook.
3. Persistent memory poisoning via web summarization. A crafted webpage, when summarized by Copilot, injects attacker instructions into the victim's permanent memory. The injection reportedly survives password changes, session revocation, and device re-enrollment.

Once triggered, the prompt has the same capabilities as any user instruction: exfiltration via OAuth connectors or chat history, memory poisoning, reconnaissance (enumerating apps/files/emails/events), and disinformation injection into future sessions.

flowchart TD
    A[Victim clicks crafted link] --> B[copilot.microsoft.com loads in authed session]
    B --> C{autorun=1 present?}
    C -->|no| D[Prompt only pre-filled, user must press Enter]
    C -->|yes| E[Prompt auto-executes silently]
    E --> F[Query connected apps]
    E --> G[Poison persistent memory]
    F --> H[Encode + exfiltrate via URL-fetch to webhook]

Preconditions / Affected

Microsoft Copilot Personal, victim in an active authenticated session with connected apps (Gmail, Drive, Calendar, OneDrive). Delivery is any clickable link — email, chat, phishing page, QR code. Only a single click on the URL is needed.

What to do

Apply Microsoft's patch shipped August 18, 2026. The page gives no separate commands or config beyond patching; the exfiltration path is designed to move large data volumes through a trusted AI workflow "without tripping the alarms security teams normally rely on," so patch state — not detection — is the primary control.

Caveats

The fetched page text is truncated mid-sentence ("The attack primitive is th…"), so the full technical breakdown and any additional mitigations are not captured here. Varonis states it has seen no evidence of exploitation in the wild.