One click on a crafted link may be enough to drain data from connected apps in Microsoft Copilot Personal, researchers at Varonis Threat Labs warn. The flaw set, named CoSnitch, is filed as CVE-2026-24301.
Microsoft received the report in December 2025 and shipped fixes on August 18, 2026. No in-the-wild exploitation has surfaced, and the findings apply to the consumer assistant at copilot.microsoft.com rather than Microsoft 365 Copilot.
The trick depends on a hidden URL parameter that Copilot itself revealed during testing. Varonis kept asking the assistant why prompts could not run without user interaction, a method the firm calls meta-hacking. The assistant eventually named autorun=1 plus the session conditions that enable it. Built exactly as described, the URL made the parameter execute a prompt on page load inside the victim’s authenticated session.
The injected prompt runs against services the user already granted access to. It encodes whatever it finds and ships the results to an attacker-controlled webhook via Copilot’s URL-fetch capability. Test runs returned mail message bodies and metadata, calendar details, Google Drive filenames, full chat history, and saved memory instructions. Network-layer inspection cannot tell the exfiltration from ordinary page-summarization fetches, and base64 encoding helps it slip past outbound filters.
A second issue writes attacker instructions into the memory store when Copilot summarizes a crafted page. Those planted instructions outlive password changes, session revocation, and device re-enrollment.
Cutting back the connected-app list, reviewing the assistant’s access like any privileged account, and treating links that open AI tools as suspicious are the practical steps Varonis recommends.
