Varonis Threat Labs has uncovered three security weaknesses in Microsoft Copilot Personal that allowed attackers to quietly extract information from linked applications and other data accessible to a victim's Copilot session through a single click on a specially designed link. The flaws, which the researchers collectively called CoSnitch, relied partly on an undocumented URL parameter that the assistant itself revealed during testing. The company reported the issue to Microsoft in December 2025, and fixes were released on August 18, 2026. CoSnitch is now tracked as CVE-2026-24301 in Microsoft's Security Update Guide.

The research team discovered the parameter by repeatedly asking Copilot why a prompt couldn't execute without user interaction, an approach Varonis calls meta-hacking. Each rejection included a technical explanation, and the assistant eventually identified a parameter called autorun=1, along with the session conditions under which it functioned and the safeguards that were meant to have blocked it. When researchers constructed the URL precisely as described, the parameter Copilot had claimed no longer worked actually executed. In testing, the researchers said Copilot returned message bodies, subject lines, and sender and recipient metadata from connected mail accounts, calendar titles, attendees, times, and locations, file names and metadata summaries from Google Drive, full prior conversation content from chat history, and the saved instructions and user-defined rules held in the memory store. The attack URL combines autorun=1 with the existing q parameter; Varonis said q alone only pre-fills the input box and that both parameters must be present for the prompt to fire without a user gesture. Once CoSnitch execution begins, the prompt runs to completion even if the victim closes the Copilot tab immediately after the page loads.

Varonis grouped the findings into three vulnerabilities: automatic prompt execution, where the two parameters together cause an attacker-supplied prompt to run on page load inside the victim's authenticated session; exfiltration through connected services, where the injected prompt can query services the user has already authorized, encode retrieved data, and use Copilot's built-in URL fetch to send it to an attacker-controlled webhook; and persistent memory writes from summarized pages, where a crafted web page, when summarized by Copilot, can cause the assistant to write attacker instructions into the user's memory store. "Copilot wasn't breached; it was played," Varonis said in its report. The research names Copilot Personal, the consumer assistant hosted at copilot.microsoft.com, and does not state that the same behavior affected Microsoft 365 Copilot. The researchers said they found no evidence that CoSnitch was exploited in the wild.

The exfiltration method works because the attacker-controlled prompt operates with the same capabilities as an instruction the user typed, and can query services the user has already authorized without granting Copilot new provider permissions or expanding the user's existing access. Varonis said the exfiltration request is indistinguishable at the network layer from the fetches Copilot performs when it summarizes an ordinary web page, and that base64 encoding can help avoid filters scanning outbound requests for sensitive patterns such as credentials. On the separate memory path, the firm said an injected instruction survives password changes, session revocation, and device re-enrollment, and stays active in later conversations until the user deletes it from Copilot's memory settings. The memory write produces no process, file, network connection, or log entry that security tooling would flag, with the change visible only in Copilot's memory interface.

Varonis advised reviewing which apps are connected to Copilot and disconnecting those not actively needed, treating the assistant as a privileged insider for access review and anomaly detection, and exercising caution with links that open AI assistants. The company did not identify a client update that users need to install. Varonis said injected memories persist until explicitly removed; its disclosure does not state whether Microsoft's remediation retroactively removed memory entries created before the fix. The disclosure comes less than two weeks after the same team detailed RovoBlast, a one-click attack on Atlassian's Rovo assistant that abused a URL parameter to seed attacker-controlled instructions into a signed-in user's session. Organizations relying on AI assistants as productivity multipliers now face a corresponding expansion in the surface area adversaries can manipulate through social engineering alone. The authentication boundary that once required stolen credentials can now be crossed with carefully worded prompts embedded in URLs that look no different from legitimate sharing links.