Varonis Threat Labs has uncovered a one-click vulnerability in Microsoft Copilot Personal, dubbed CoSnitch and tracked as CVE-2026-24301, which quietly executes an attack chain that exfiltrates data from enterprises without obvious red flags. Microsoft patched the vulnerability on August 18, 2026, following responsible disclosure by Varonis Threat Labs. Microsoft assigned CVE-2026-24301 a severity score of 8.8 under CVSS 3.1. Varonis reported CoSnitch to Microsoft in December 2025, and the company says it has found no evidence of active exploitation before the patch shipped.
CoSnitch resulted from three separate weaknesses that could be chained together to execute attacker-controlled prompts, access linked accounts, and exfiltrate data without meaningful user interaction. The undocumented "?autorun=1" parameter, when paired with Copilot's standard query parameter, caused Copilot to automatically execute an embedded prompt the moment a victim's browser loaded the page; the embedded command could then act within the victim's authenticated session and retrieve information from connected services including Gmail, Google Drive, Google Calendar, Copilot memory, and Copilot chat history. A third component allowed a booby-trapped webpage, when summarized by Copilot, to inject hidden instructions directly into the assistant's permanent memory, with that poisoned memory persisting even through password changes, session revocations, and device re-enrollment, meaning standard incident response steps would not remove it. The exfiltration technique relied on Copilot's routine capability to retrieve and summarize external URLs: a malicious prompt could gather data into the model's active context, encode it for URL transport, and instruct Copilot to request an attacker-controlled URL, with the outbound request resembling a standard HTTPS fetch that Copilot typically performs during normal web summarization.
What makes CoSnitch distinctive is how Copilot surfaced its own vulnerabilities, a method Varonis calls meta-hacking: researchers did not reverse-engineer the flaw, but instead allowed the AI to expose the weakness during normal use. The technique involves social engineering the AI's reasoning engine and manipulating it into disclosing things it should not. Varonis also found that once CoSnitch execution begins, the prompt runs to completion even if the victim closes the Copilot tab immediately after the page loads. A Microsoft spokesperson told Dark Reading that no customer action is required and that enterprise customers are unaffected, as CoSnitch affected only Copilot Personal.
CoSnitch is the third Copilot vulnerability Varonis has uncovered this year, following Reprompt, which bypassed Copilot's safety guardrails simply by asking a question twice, and SearchLeak, which turned Microsoft 365 Copilot Enterprise into a covert exfiltration channel. All three exploits share a common thread: a single click on what looks like an ordinary link is all it takes to trigger the attack chain, with no obvious warning signs for the victim or their security team. Skeptics note that the indirect prompt injection weakness underlying CoSnitch is not wholly new; the flaw stems from the established fact that AI cannot reliably differentiate between instructions and data to be analyzed, and prior researchers have observed this class of attack before. Still, the case underscores a broader problem: as AI copilots gain deeper access to enterprise email, files, calendars, and chat histories, a single compromised link can move large volumes of sensitive data through what looks like completely routine assistant behavior.
Three critical exfiltration bugs in a single AI product within one calendar year is not a run of bad luck; it is an architecture under pressure from a class of attack it was not designed to resist.