CoSnitch: One Click Steals Data from Copilot Personal

Researchers at Varonis Threat Labs have reported three vulnerabilities in Microsoft Copilot Personal — the consumer assistant at copilot.microsoft.com. According to their findings, a single click on a specially crafted link was enough to silently extract data from a victim's connected apps within their session. The set of issues was named CoSnitch and tracked as CVE-2026-24301. Microsoft was notified of the discovery in December 2025, and the patch shipped on August 18, 2026. No signs of exploitation in real-world attacks were found. The researchers note separately that Microsoft 365 Copilot is not covered by the study.

The assistant handed over the loophole itself

The most curious part is how the researchers found the vulnerability. They called it “meta-hacking”: over and over they asked Copilot why a prompt couldn't run without user action. Each refusal came with a technical justification, and eventually the assistant named an undocumented autorun=1 parameter, the session conditions under which it fires, and the defenses that were supposed to disable it. When the URL was assembled exactly as described, the parameter Copilot said no longer worked — worked. “Copilot wasn't hacked, it was outplayed,” Varonis concluded.

How the attack works

The autorun=1 parameter, paired with the already-known q, forces someone else's prompt to execute when the page loads inside an authenticated session — with the same privileges as if the user had typed the command themselves. On its own, q merely fills in the input field; both are needed. Once launched, the prompt runs to completion even if the victim immediately closes the tab.

The injected instruction reaches out to already-authorized services, encodes what it retrieves, and uses Copilot's built-in URL-fetching feature to send the data to a webhook under the attacker's control. No new permissions are granted in the process. In testing, the researchers were able to pull email bodies and headers, sender metadata, meeting titles and participants, file names from Google Drive, the full history of past conversations, and saved rules from the memory store. At the network level, such a request is indistinguishable from an ordinary page load for summarization, and base64 encoding helps slip past filters.

Poisoning the memory

The third, standalone vulnerability works through web page summarization. When summarized, a crafted page makes Copilot write the attacker's instructions into the user's memory, where they influence future sessions. Such an entry survives a password change, session revocation and device re-enrollment, and remains active until the user deletes it themselves in the memory settings. Meanwhile it leaves behind no process, no file, no network connection and no log entry.

Varonis advises checking which apps are connected to Copilot, disconnecting any that aren't needed, treating the assistant as a privileged insider, and being cautious about opening links that launch AI assistants. No separate client-side update is required, though the report doesn't clarify whether the fix removed malicious memory entries that had already been created.

Source: The Hacker News