CoSnitch Explained: How Microsoft Copilot’s One-Click Flaw Could Expose Connected Data

CoSnitch was not a single isolated bug but a chain of three weaknesses in Microsoft Copilot Personal. According to Varonis Threat Labs, a crafted link could trigger an attacker-controlled prompt in a victim’s authenticated Copilot session, use the assistant’s existing access to connected services, and potentially implant instructions in persistent memory. Varonis tracked the chain as CVE-2026-24301 and described it as critical. The supplied sources do not establish a numeric CVSS score.

How “meta-hacking” uncovered the attack path

The discovery was unusual because the researchers did not begin by reverse-engineering Copilot’s implementation. Lior Adar repeatedly asked Copilot why a hypothetical automatic-execution attack should not work. Copilot’s refusals reportedly exposed details about its own defenses and eventually disclosed the undocumented autorun=1 URL parameter. Varonis called this technique meta-hacking: using an AI assistant’s responses about its own safeguards to identify a weakness in those safeguards.

That finding turned a theoretical attack into a practical chain. The parameter alone was not the entire vulnerability; its significance came from how it interacted with Copilot’s normal query mechanism and other capabilities.

The three weaknesses behind CoSnitch

1. An undocumented automatic-execution parameter

Copilot supported an undocumented autorun=1 parameter that could cause a prompt to run automatically when a page loaded in an authenticated session. The parameter was not presented as an ordinary user-consent step, creating the first link in the chain.

2. Silent prompt injection through a crafted link

When combined with Copilot’s q= query parameter, autorun=1 allowed an attacker to place a prompt in a specially crafted link and trigger it when the victim opened the link. In the reported demonstration, the victim did not need to approve the prompt through an obvious additional interaction.

This matters because the link moved the attack from a conversation a user intentionally started to an instruction delivered through an external page or message. The assistant then processed the attacker’s text within the victim’s existing session.

3. Access to connected data and persistent memory

The injected prompt could direct Copilot to retrieve information available through the victim’s authorized connections, encode that information, and send it to an attacker-controlled endpoint using Copilot’s URL-fetch capability. The same chain could also cause Copilot to summarize an attacker-controlled webpage, allowing malicious instructions in that content to be written into persistent memory.

The result was broader than ordinary prompt injection. It combined automatic execution, access to user-authorized information, and an output channel controlled by the attacker. Persistent-memory injection added a further risk: malicious instructions could influence later interactions rather than affecting only the initial conversation.

What information could be exposed?

CoSnitch did not independently break into every connected service. It operated through the permissions already available to the victim’s Copilot session, so the potential exposure depended on the account’s connected applications and authorizations. Reported examples included Gmail, Google Drive, OneDrive, calendars, email, files, and Copilot chat history.

That distinction is important for assessing risk. A user with few connected services would present a smaller data-access surface than a user whose assistant could search across personal or organizational information. The attack’s reach was therefore shaped by the permissions granted to the AI assistant.

CVE, severity, patch status, and exploitation

Varonis identified the chain as CVE-2026-24301 and called it critical. However, the sources supplied for this article do not provide a reliable numeric CVSS rating, so a specific score should not be inferred from the critical designation.

Varonis said it reported CoSnitch to Microsoft in December 2025, and the available reporting says Microsoft shipped patches on August 18, 2026. Some of the supplied material refers to an earlier mitigation in February 2026, but it does not establish which part of the chain that mitigation addressed or how it differed technically from the August remediation.

Varonis reported no evidence that CoSnitch had been exploited in the wild. The supplied evidence also does not establish that CVE-2026-24301 appeared in CISA’s Known Exploited Vulnerabilities Catalog. That means there is no documented exploitation in the material reviewed here—not proof that exploitation never occurred.

Did CoSnitch affect Microsoft 365 Copilot Enterprise?

The research described in the supplied sources focused on Microsoft Copilot Personal. The potential impact could nevertheless reach organizational information if a person used Copilot Personal while authenticated to or connected with enterprise services.

That is different from establishing an independent vulnerability in Microsoft 365 Copilot Enterprise itself. One supplied source makes that distinction explicitly, while another secondary report claims broader enterprise impact; the evidence provided here is not sufficient to resolve that conflict. The careful conclusion is that organizations should assess connected-account permissions and update status, but should not describe the research as proof that Microsoft 365 Copilot Enterprise had the same vulnerability.

How CoSnitch fits Varonis’s earlier AI security research

CoSnitch was part of a broader set of Varonis findings about AI assistants that can act on information already available to a user:

• Reprompt involved bypassing Copilot guardrails by repeating queries.
• SearchLeak was described as turning Microsoft 365 Copilot Enterprise into a silent exfiltration tool.
• RovoBlast applied a related concern to Atlassian Rovo, where malicious content could steer an assistant with access to enterprise information into disclosing or acting on that data.

CoSnitch’s distinctive feature was the discovery method. Rather than merely placing malicious instructions in content, the researchers used Copilot’s own explanations of why automatic execution should fail to uncover the undocumented mechanism that made the attack possible. That combination of self-disclosure, prompt injection, authorized data access, and persistent memory manipulation is what made the chain notable.