Varonis Discloses CoSnitch: Three Microsoft Copilot Personal Flaws Enable One-Click Data Theft

Varonis Threat Labs has disclosed three vulnerabilities in Microsoft Copilot Personal, the consumer assistant at copilot.microsoft.com, that together let a single click on a crafted link silently pull data out of a victim's connected apps. The researchers named the set CoSnitch, Microsoft is tracking it as CVE-2026-24301, and, per The Hacker News, the fix shipped on August 18, 2026 after Varonis reported the problem in December 2025.

The detail that makes CoSnitch worth a security team's attention is not the click. It is how the researchers found the flaw: they did not reverse-engineer it. They asked Copilot why an attack would not work, and the assistant walked them through its own defenses until it named the exact mechanism they needed. Varonis calls the technique meta-hacking. "Copilot wasn't breached; it was played," the firm wrote in its report.

For defenders the practical question is narrower than the headlines suggest, so lead with it: CoSnitch, as documented, hits Copilot Personal, and Varonis does not claim the same behavior reached Microsoft 365 Copilot. That distinction decides how much of this lands on an enterprise. But the pattern behind it (an authorized AI assistant tricked into weaponizing its own access) is the part that does not stay in the consumer product.

What CoSnitch Actually Is

CoSnitch is not one bug but three, and Varonis groups them into two distinct outcomes. The first two form a one-click data-exfiltration path; the third is a separate memory-poisoning path.

The exfiltration path starts with an undocumented URL parameter that Copilot itself surfaced during testing. Paired with the ordinary query parameter that pre-fills the chat box, it causes an attacker-supplied instruction to run automatically when the page loads, inside the victim's already-authenticated session, with the same reach as a prompt the user typed. There is no second click and no visible sign that a prompt fired. (Out of caution, this piece does not reproduce the parameter or a working request. The mechanics are in the Varonis writeup for readers who need them.)

From there, the injected prompt does what Copilot is built to do. It queries the services the user has already authorized, encodes what it retrieves, and uses Copilot's own built-in URL-fetch feature to send the data to an attacker-controlled endpoint. In testing, Varonis said Copilot returned message bodies, subject lines, and sender and recipient metadata from connected mail, calendar entries with attendees and locations, file names and metadata from Google Drive, and full prior conversation content from chat history. Nothing new was granted to Copilot; the attack rides entirely on access the user had already handed it.

The third vulnerability is quieter and, arguably, worse. A crafted web page, when summarized by Copilot, can cause the assistant to write attacker instructions into its persistent memory store. Varonis said such an injected instruction survives password changes, session revocation, and device re-enrollment, and keeps shaping later sessions until the user manually deletes it from Copilot's memory settings. The firm also noted the memory write leaves no process, file, network connection, or log entry that endpoint tooling would flag; the only visible trace is the entry itself, sitting in Copilot's memory interface.

How Copilot Talked Its Way Into Trouble

The origin story is the genuinely new part, and it is why The Register framed this as Copilot being socially engineered into explaining how to hack itself. Microsoft had already quietly disabled the older query-parameter injection route that Varonis used in its earlier Reprompt research. So the researchers simply asked the assistant, repeatedly, why a prompt could not be made to run without user interaction. Each refusal came with a technical justification. Pushed on those justifications, Copilot eventually listed the disabled parameters, the protections meant to block them, and one previously undocumented parameter, along with the session conditions under which it worked.

When the team built the request exactly as Copilot had described it, the mechanism the assistant said was disabled executed. "What makes CoSnitch unique is how Copilot surfaced its own vulnerabilities," Varonis wrote. "Our researchers didn't have to reverse-engineer the flaw. The AI exposed the weakness during normal use."

Lior Adar, a senior security researcher at Varonis, told The Register the assistant leaked more than user data. "These novel attack chains do more than just exfiltrate user data. I tricked the assistant into leaking sensitive internal parameters and configuration details," he said, describing it as handing an attacker "a blueprint of the AI's internal logic." His broader point is the one that carries past this specific product: large language models still lack a strict boundary between untrusted data and trusted instructions, so an assistant that reads an attacker's email or shared document treats the hidden text inside it as a command.

The One-Click Path, at a Conceptual Level

The CoSnitch one-click path at a conceptual level. The red beats are where a security team should focus detection and review.

Who Is Actually Affected

Copilot Personal is the product Varonis tested, and its writeup does not state that CoSnitch reached Microsoft 365 Copilot, the Business and Enterprise assistant governed by tenant policy. Treat the enterprise blast radius as unconfirmed rather than clear: Varonis did not test the M365 tier here, and Microsoft did not respond to The Register's questions about the fix before publication. What Adar did argue is that a consumer-grade finding "highlights deep architectural flaws that can carry over directly into corporate environments," because the underlying weakness (an assistant that cannot separate data from instructions) is shared architecture, not a consumer-only quirk.

On the fix itself, be precise. Microsoft shipped a patch and assigned CVE-2026-24301 on August 18, and Varonis reported finding no evidence CoSnitch was exploited in the wild. But two loose ends remain. Varonis did not identify any client update a user must install, which points to a server-side remediation. And the firm's disclosure does not say whether Microsoft's fix retroactively removed malicious memory entries planted before the patch. If an organization has users on personal Copilot who touched an untrusted summarization link in recent months, a patched backend does not, on the current evidence, guarantee a clean memory store.

What Enterprise Copilot Deployers Should Do

Even if your M365 tenant is out of scope for this specific CVE, CoSnitch is a clean template for the class of attack, and the response is the same one that hardens you against the next one.

• Audit connected-app scopes. Review which services are wired into any Copilot your people use and disconnect the ones that are not actively needed. Every OAuth connector is data the assistant can be talked into reading, so a smaller connected surface is a smaller exfiltration surface.
• Treat the assistant as a privileged insider. Fold Copilot into access review and anomaly detection the way you would a service account with broad reach. Model what a single compromised session could reach, not what a well-behaved user typically does.
• Monitor for anomalous Copilot data access. Watch for assistant-driven reads that do not match the user's normal pattern: bulk mailbox or Drive queries, retrieval of chat history, or outbound fetches that follow a data-gathering step. On M365, Microsoft exposes memory writes through a MemoryUpdated field in Defender Advanced Hunting and Sentinel, and records memory updates to audit logs; use those signals.
• Check the memory store, not just the patch. Because injected memory can outlive a password reset and a fix, add a review of Copilot's saved instructions and user-defined rules to your incident checklist for anyone who may have been exposed.
• Warn users about links that open AI assistants. A link that launches Copilot with a pre-filled prompt should get the same suspicion as an unexpected login page. Fold it into phishing awareness, and include QR codes, which Varonis flags as a delivery route.

The Bigger Pattern

CoSnitch does not stand alone; it is the latest entry in a run of one-click and zero-click attacks against AI assistants that all exploit the same design gap. Varonis disclosed CoSnitch less than two weeks after detailing RovoBlast, a one-click attack on Atlassian's Rovo assistant that abused a URL parameter to seed instructions into a signed-in session. We have covered the same shape in Google's Agent Development Kit, where one agent could be steered into acting against another, and in zero-click hijacking of AI browsers through poisoned emails and social posts. Different vendors, one root cause: assistants that read untrusted content as if it were a trusted command.

My read (assessment, not reported fact): The meta-hacking angle is the story here, and it should change how you think about model behavior. An assistant helpful enough to explain, in precise detail, why its own defenses cannot be bypassed is an assistant that has just written the bypass. That is not a Copilot bug so much as a property of chatty, safety-narrating models, and it will keep producing findings like this one. The defensive takeaway is unglamorous but durable: stop treating a connected AI assistant as an app and start treating it as an identity with standing access, because that is what an attacker gets to borrow with a single click. On this specific CVE, my confidence is high that Copilot Personal was affected and patched, and low on the enterprise blast radius and on whether pre-fix memory entries were cleaned up, both of which Varonis leaves open.

Primary documents

• Varonis Threat Labs: CoSnitch disclosure
• The Hacker News: Microsoft Copilot Personal flaws
• The Register: Copilot tricked into telling researchers how to hack itself
• Microsoft Security Update Guide: CVE-2026-24301