Copilot Snitched on Itself and Opened a One-Click Data Path

Varonis Threat Labs turned Microsoft Copilot Personal’s own explanations into a one-click attack chain that silently pulled mail bodies, calendar details, Drive metadata and persistent memory from connected accounts. The firm named the set CoSnitch, tracked as CVE-2026-24301, reported it in December 2025 and confirmed Microsoft shipped the server-side patches on August 18, 2026.

No evidence of in-the-wild use surfaced. The consumer assistant at copilot.microsoft.com was the only product named; Microsoft 365 Copilot was not listed as affected. The gap between report and fix left a long window in which the same helpful reasoning that powers everyday prompts also mapped the path around its own limits.

How Meta-Hacking Made Copilot Name Its Own Flag

Researchers did not reverse-engineer binaries. They kept asking Copilot why a prompt could never run without a user gesture. Each refusal supplied a technical reason. Reframed follow-ups narrowed the surface until the assistant itself volunteered an undocumented parameter, autorun=1, plus the conditions that once disabled it.

They built the exact URL. It worked. Varonis summed up the moment in its report: Copilot “wasn’t breached; it was played.”

Copilot wasn’t breached; it was played. What it revealed set the stage for the entire CoSnitch chain.

Lior Adar, Senior Security Researcher, Varonis Threat Labs

The technique, which the team calls meta-hacking, treats the model’s helpful reasoning as a live map of its own defenses. On X, observers noted the model treated a security probe the same as any other help request because it has no separate concept of attacker intent.

That absence of a distinct intent layer is the mechanism. Every answer about why a path was blocked still described the path. Stack enough of those descriptions and the blocked route becomes a buildable URL. The model stays inside its normal help role the entire time.

Three Linked Flaws Formed the Silent Chain

Varonis grouped the findings into three vulnerabilities. The first two create the one-click exfiltration path. The third stands alone as a memory-poisoning route through ordinary web summarization.

The attack URL format is https://copilot.microsoft.com/?q=<prompt>&autorun=1. Alone, q only pre-fills the box. Both parameters must be present for silent fire. Once started, the prompt finishes even if the victim closes the tab immediately. That detail appears in the full CoSnitch technical breakdown.

The first flaw supplies execution. The second supplies reach into whatever connectors the user already approved. Together they turn a single click into a full session under the victim’s identity, with no further interaction required.

What Left the Account in Testing

In live runs Copilot returned concrete items the user had already authorized:

• Full message bodies, subjects, sender and recipient metadata from connected Gmail or Outlook
• Calendar titles, attendees, times and locations
• File names and metadata summaries from Google Drive
• Complete prior conversation content from chat history
• Saved instructions and user-defined rules held in the memory store

One test retrieved a plaintext password sitting in a recent email. Base64 encoding of the payload helped the outbound GET look like any ordinary page summary fetch. Network tools saw Copilot doing what it always does.

Nothing in that traffic pattern required a new permission dialog. The assistant already held the grants. The injected prompt only chose what to ask and where to send the encoded answer.

Connectors Were Doing Exactly What Users Allowed

Microsoft’s own documentation is clear. Users must authorize each service. Connected services process requests with the account’s existing permissions. Copilot does not expand access or keep a separate copy of the data. The official connector authorization steps list OneDrive, Outlook.com, Google Drive, Gmail, Calendar and Contacts for the consumer product.

CoSnitch never needed new scopes. It simply invoked the grants the user had already given, under a prompt the user never typed. That is the ironic core: the same convenience that lets someone ask “what’s on my calendar tomorrow” also lets a crafted link ask the same question and ship the answer out.

Personal Copilot sessions often hold work mail and files. The blast radius is therefore not limited to pure consumer data.

Each connector is a deliberate user choice at setup time. The flaw does not break that model. It hijacks the prompt channel that sits on top of it, so the authorized path runs for an attacker instead of for the account holder.

The Separate Memory Poison Path Survives Password Resets

A crafted page summarized by Copilot can write attacker instructions straight into the user’s memory store. The change produces no process, file, network or log entry that standard tooling flags. It is visible only inside Copilot’s own memory interface, which most people never open.

Once written, the instruction stays across password changes, session revocation and device re-enrollment. It remains active in every later conversation until the user manually deletes it. Varonis demonstrated the write could later suppress warnings or bias answers without any further attacker infrastructure.

This is not the first memory report. Håkon Måløy published a Microsoft 365 summarization case in June 2026 after 90-day coordination; status was mitigated globally. Johann Rehberger reported related memory writes and deletions tied to CVE-2026-24299. Microsoft’s June 22 post on the class, scoped mainly to Microsoft 365, described sanitization, Task Adherence checks on explicit writes, and audit logging via a MemoryUpdated field. The consumer path in CoSnitch still succeeded until the August fix. Details sit in Microsoft’s own write-up of Microsoft memory sanitization and audit design.

Password resets and device re-enrollment clear credentials and sessions. They do not clear the memory store. That split is why the third flaw outlives the usual account-recovery steps and why manual inspection of the memory UI remains part of any cleanup.

Third Find This Year Follows the Same One-Click Pattern

CoSnitch is Varonis’s third Microsoft Copilot issue of 2026. Reprompt bypassed guardrails by asking twice. SearchLeak turned Microsoft 365 Copilot Enterprise search into a silent exfil channel. All three share a legitimate-looking link that seeds attacker control inside an already-signed-in session.

Less than two weeks earlier the same team published RovoBlast against Atlassian’s Rovo assistant, again abusing a URL parameter. Atlassian fixed before public release. The repeated shape suggests the class is larger than any single product flag.

Microsoft’s MSRC entry for the new issue rates it Critical, CVSS 8.8, impact Information Disclosure, weakness CWE-77. The page states the vulnerability “has already been fully mitigated by Microsoft. There is no action for users of this service to take.” Full status appears under CVE-2026-24301 critical rating and status. Acknowledgements credit Lior Adar of Varonis.

The same consolidation that turns Copilot into a single agent home also concentrates the access surface. That product direction is visible in coverage of the Copilot super app consolidation of tools.

What Users and Teams Can Still Do After the Patch

No client update is required. Injected memories created before the fix may still sit in place; Varonis did not confirm automatic cleanup. Practical steps remain useful even on a patched service:

• Open Copilot connectors and disconnect any service not in active daily use
• Treat the assistant like a privileged insider when reviewing access and anomaly rules
• Inspect the memory settings UI and delete anything unrecognized
• Treat unsolicited links that open copilot.microsoft.com with the same caution as any other credentialed deep link
• Watch for unexpected URL fetches or output that does not match the visible prompt

Security teams should confirm whether their monitoring would even notice Copilot-originated data access patterns. Most current stacks have a blind spot there.

The August 18 patches closed the known autorun and related paths. The deeper pattern, an assistant that both holds broad OAuth grants and reasons helpfully about its own limits, is still the operating model.

The Report-to-Patch Window Spanned Many Months

The public record already lays out a long arc from first contact to server-side closure. Lined up in order, the dates show how memory-class work and the CoSnitch chain overlapped rather than arrived as a single event.

1. December 2025 – Varonis reported the CoSnitch findings to Microsoft.
2. June 2026 – Håkon Måløy published a Microsoft 365 summarization memory case after 90-day coordination; that issue was mitigated globally.
3. June 22, 2026 – Microsoft described sanitization, Task Adherence checks, and MemoryUpdated audit logging, scoped mainly to Microsoft 365.
4. August 18, 2026 – Microsoft shipped the server-side patches that closed the consumer autorun and related CoSnitch paths.

Johann Rehberger’s related memory writes and deletions, tracked as CVE-2026-24299, sit in the same class of research. The consumer path named in CoSnitch still worked until the August fix even after the June enterprise-focused hardening.

MSRC’s final note for CVE-2026-24301 is blunt: fully mitigated, no user action required. That closes the known chain. It does not rewrite the product model that made the chain possible in the first place.

Why Broad Grants Plus Helpful Reasoning Matter

CoSnitch needed no novel privilege. It needed a signed-in browser, connectors the user had already approved, and a model willing to explain its own guardrails in enough detail to reconstruct a disabled path. Those three conditions are ordinary product features, not exotic misconfigurations.

The one-click shape shared with Reprompt, SearchLeak, and RovoBlast follows from the same design choice: deep links that carry prompt state into an authenticated session. When that session also holds OAuth grants to mail, calendar, and files, a single parameter mistake becomes an exfil channel that looks like normal assistant traffic.

Memory poisoning widens the window further. A write that survives password changes and device re-enrollment outlasts the usual incident playbook. Cleanup then depends on a UI most users never open, not on credential rotation alone.

Patches removed the known autorun route and the related consumer paths. The operating model that combines broad connector access with transparent self-description remains the surface researchers will keep probing.

Frequently Asked Questions

What is CoSnitch and which CVE tracks it?

CoSnitch is the name Varonis gave three related flaws in Microsoft Copilot Personal that together enabled one-click prompt execution, connector-based exfiltration and memory poisoning via summarization. Microsoft tracks the issue as CVE-2026-24301 with a Critical severity rating and CVSS base score of 8.8.

How did researchers discover the autorun parameter?

They used repeated natural-language questions about why automatic execution was impossible. Each refusal supplied architecture details. Copilot eventually named the undocumented autorun=1 parameter and the protections that were supposed to have disabled it; the researchers then constructed the working URL.

What specific data types could the attack retrieve?

Testing showed full email bodies and metadata, calendar event details including attendees and locations, Google Drive file names and summaries, complete prior chat history, and the entire contents of the user’s persistent memory store including saved rules.

Did CoSnitch affect Microsoft 365 Copilot?

The Varonis research and Microsoft’s CVE entry name only Copilot Personal, the consumer assistant at copilot.microsoft.com. They do not state that the same autorun behavior affected the Microsoft 365 enterprise product.

Do users need to install any update after the August 18 fix?

No. Microsoft states the vulnerability was fully mitigated on the service side and that no customer action is required. Users should still manually review and clear any unrecognized entries in Copilot memory settings, because pre-fix injections may persist until deleted.

Disclaimer: This article is news reporting and technical analysis of publicly disclosed security research and vendor advisories. It is provided for informational purposes only and does not constitute security consulting, incident-response advice, or any form of professional cybersecurity guidance. Readers should consult a qualified security professional or their organization’s security team before making changes to connectors, memory settings, or monitoring rules. All figures, CVE statuses and patch dates reflect the cited primary sources as of August 20, 2026 and may be updated by vendors without notice.