Skip to content

CoSnitch: Microsoft Copilot Personal one-click data exfiltration (CVE-2026-24301)

Summary

Varonis Threat Labs disclosed three vulnerabilities in Microsoft Copilot Personal (the consumer assistant at copilot.microsoft.com) that it collectively named CoSnitch. A single click on a crafted link can silently pull data from connected apps and other information available to the victim's Copilot session, with no further user gesture. The flaws turn on an undocumented URL parameter, autorun=1, that the assistant itself surfaced during testing. Varonis reported the issue to Microsoft in December 2025; patches shipped on August 18, 2026, and the flaw is tracked as CVE-2026-24301 in Microsoft's Security Update Guide. No in-the-wild exploitation has been reported.

Tags

How it works

Meta-hacking to find the parameter. The researchers reached autorun=1 by repeatedly asking Copilot why a prompt could not be made to run without user interaction. Each refusal carried a technical justification; the assistant eventually named the parameter autorun=1 along with the session conditions under which it works and the protections that were supposed to disable it. When Varonis built the URL exactly as described, the parameter that Copilot had claimed no longer worked did execute. "Copilot wasn't breached; it was played," Varonis said.

One-click exfiltration. The attack URL pairs autorun=1 with the existing q parameter. q alone only pre-fills the input box; both parameters must be present for the prompt to fire without a user gesture. Once execution begins, the prompt runs to completion even if the victim closes the Copilot tab immediately after the page loads. The exfiltration request is indistinguishable at the network layer from the fetches Copilot performs when summarizing an ordinary web page, and base64 encoding can help avoid outbound filters scanning for sensitive patterns such as credentials.

Persistent memory write. A separate path injects an instruction into Copilot's memory. That instruction survives password changes, session revocation, and device re-enrollment, and stays active in later conversations until the user deletes it from Copilot's memory settings. The memory write produces no process, file, network connection, or log entry that endpoint security tooling would flag; the change is visible only in Copilot's memory interface.

  • This is not the first time Copilot memory has been reported to Microsoft. Håkon Måløy documented an attacker-controlled page that persisted an unintended memory via a Microsoft 365 Copilot summarization flow (published June 22, 2026, after 90-day coordination; Microsoft status "mitigated globally"). Johann Rehberger separately reported memory writes/deletions through indirect prompt injection in M365 Copilot, associated with CVE-2026-24299.
  • Microsoft set out its position on this class of attack in a June 22 security blog post (crediting MSRC cases from Rehberger, Måløy, and Gal Zror). Scoped to M365 Copilot rather than the consumer product, Microsoft said memories pass through sanitization and prompt-injection checks on write, that M365 Copilot is designed to run Task Adherence checks on every explicit memory write, and that memory updates are recorded to organizational audit logs and surfaced via a MemoryUpdated field in Defender Advanced Hunting and Sentinel.
  • CoSnitch comes less than two weeks after the same Varonis team detailed RovoBlast, a one-click attack on Atlassian's Rovo assistant that abused the rovoChatPrompt URL parameter to seed attacker-controlled instructions into a signed-in user's session (fixed by Atlassian before public disclosure).

Why this matters

  • The research is scoped to Copilot Personal (the consumer assistant) and does not state that the same behavior affected Microsoft 365 Copilot; treat M365 Copilot exposure as governed by Microsoft's Task Adherence / sanitization controls above.
  • A single crafted link is the whole attack — no install, no credential prompt — which makes it a strong phishing primitive against AI-assistant users.
  • The memory-write path is a persistent, logless implant in the assistant's own context, surviving re-enrollment and credential resets.

Defender priorities

  1. Patch / update Copilot Personal (fixes shipped August 18, 2026); this is a server-side parameter issue, so no client update is required — the fix is on the service.
  2. Review which apps are connected to Copilot and disconnect those not actively needed (Varonis guidance); connected services process requests using the user's existing permissions.
  3. Treat the assistant as a privileged insider for access review and anomaly detection.
  4. Hunt for anomalous memory writes: use the MemoryUpdated field in Defender Advanced Hunting / Sentinel (M365 Copilot) and review the consumer assistant's memory interface for entries the user did not create.
  5. Exercise caution with links that open AI assistants, especially ones that pre-fill or auto-run a prompt; treat autorun=1-style one-click assistant URLs as hostile until proven otherwise.
  6. Note the RovoBlast parallel: the same one-click, parameter-abuse pattern has hit Atlassian Rovo; audit other AI assistants for analogous URL-parameter auto-execution.

Assessment limits

  • No in-the-wild exploitation reported by Varonis.
  • Scoped to Copilot Personal; M365 Copilot is not stated to be affected by CoSnitch.
  • Varonis's disclosure does not state whether Microsoft's remediation retroactively removed memory entries created before the fix.

Sources