Microsoft Copilot Personal had a critical hole in it. Tracked as CVE-2026-24301 and nicknamed CoSnitch, it let an attacker silently pull sensitive data from a victim’s connected accounts after one click on a malicious link. Varonis Threat Labs found it. Microsoft patched it on August 18, 2026. There is no evidence it was used in the wild before the fix landed, which is the only good news in this pile.

This is the third Copilot vulnerability Varonis has uncovered this year. The earlier ones were Reprompt, which bypassed Copilot’s safety guardrails by asking a question twice, and SearchLeak, which turned Microsoft 365 Copilot Enterprise into a quiet data-exfiltration channel. All three share the same ugly pattern. One click on a link that looks ordinary. No pop-up. No warning. No obvious sign for you or your security team.

How CoSnitch actually worked

It was not one bug. It was three weaknesses stacked on top of each other.

First, an undocumented URL parameter, used with Copilot’s normal “?q=” query string, let an attacker-crafted prompt run the moment the victim’s browser loaded the page. No extra click. No keystroke. No confirmation. Load the page and the prompt fires.

Second, once that prompt ran, Copilot could query the victim’s linked apps. Gmail. Google Drive. Calendar. Then it shipped the stolen data to an attacker-controlled server using Copilot’s own built-in URL-fetching feature. The data went out base64-encoded as a routine outbound web request. To a security tool, it looked exactly like Copilot doing normal browsing. Nothing to flag. Nothing to stop.

Third, and this is the part that should make you sit up, a booby-trapped webpage could be summarized by Copilot in a way that injected hidden instructions into the assistant’s permanent memory. That poisoned memory stuck around through password changes, session revocations, and even device re-enrollment. Standard incident response would not have cleaned it out.

You change your password. You kick the session. You re-enroll the device. The snitch is still sitting in memory, waiting.

They talked the AI into drawing its own map

Varonis did not reverse-engineer the code to find this. They asked Copilot, over and over, why automatic execution “wasn’t possible.” Every time Copilot refused, they reframed the refusal as a follow-up question. Copilot’s own explanations, meant to prove the attack could not work, ended up mapping its internal architecture and handing over the undocumented parameter that made it work.

Varonis calls that meta-hacking. Social engineering the AI’s reasoning instead of attacking the code. If that does not make you rethink how much of your life you have handed to a chat box, I do not know what will.

Varonis reported CoSnitch to Microsoft in December 2025. Microsoft says it found no evidence of active exploitation before the August 18 patch. Take that at face value if you want. The bigger problem is the pattern, not this one CVE.

Why this matters if you actually use Copilot

Copilot is not a toy on the side of your screen. Once you connect Gmail, Drive, Calendar, and the rest, it has the keys to the same rooms a trusted employee would have. A single bad link can move a lot of private data through traffic that looks completely normal. Your email. Your files. Your schedule. Out the door, dressed up as the assistant doing its job.

Security teams are being told to treat Copilot like a privileged insider, because that is what it is. Same access review you would give a person with a badge. Same questions about what it can touch and why.

If you are a regular person using Copilot Personal, you are not off the hook. Connected accounts are connected accounts. The patch is out. That does not undo whatever was already linked, and it does not fix sloppy habits around mystery links.

What you should do now

• Confirm Copilot is updated past the August 18, 2026 patch. Do not assume it happened on its own.
• Audit every third-party app still connected to Copilot. Gmail, Drive, Calendar, anything else. If you do not need it linked, disconnect it.
• Stop treating Copilot as a harmless helper. It has the same reach as a person you gave your logins to.
• If you run a small shop, ask whether your monitoring can even see odd data access coming from an AI assistant. A lot of tools cannot. That is a blind spot, not a theory.
• Do not click links you did not expect, even if they look like they go to Microsoft. One load of the page was enough to start this chain.
• If you ever thought a password reset would clean a compromised Copilot session, it would not have. Memory poisoning survived that. Keep that in mind the next time someone tells you “just reset it.”

AI copilots keep getting deeper into email, files, calendars, and chat history. Every time that happens, the blast radius of one dumb click gets bigger. Microsoft patched this one. Varonis already found two others this year. I would not bet the farm that CoSnitch is the last time an assistant quietly walks your data out the door.

Primary Source: https://cybersecuritynews.com/copilot-cosnitch-vulnerability/