This is about Microsoft Copilot Personal, the free consumer chat assistant at copilot.microsoft.com, not GitHub Copilot (the coding autocomplete tool) or Microsoft 365 Copilot for work and school accounts. The enterprise version has had its own separate, since-patched issues, but this piece focuses on the consumer product.
If you wanted to break into a locked house, you probably would not try picking the lock first. You might ask the homeowner to explain, in detail, why their security system could not be bypassed. In hoping to reassure you, they accidentally describe exactly how it works.
That is precisely how Varonis Threat Labs cracked open Microsoft Copilot Personal. They did not decompile code or study leaked source files. They simply kept asking the AI why a certain action was blocked until it handed them the exact steps to bypass its own defenses.
The result is CoSnitch (officially CVE‑2026‑24301), rated CVSS 8.8. It is a critical, one‑click vulnerability chain that silently exfiltrated data from connected apps like Gmail, Google Drive, and Calendar. While the flaw has been patched, it highlights a growing class of risks tied to AI assistants that read your messages, files, and browsing history.
How Researchers Talked an AI Into Confessing
The twist here is that Copilot behaves like most AI chat interfaces: it will not run code or execute commands automatically just because you visit a page. You must click Send. Rather than trying to force execution, the researchers asked a seemingly innocent question: could a link be constructed that makes you run a command without me pressing anything?
Copilot said no. To be helpful, it explained which safeguards prevented it. Instead of stopping there, the researchers rephrased the question as a series of follow‑ups: what about this URL structure, what happens if a field is pre‑filled, and so on. Each answer was meant to reassure them, but together they mapped out Copilot’s internal routing. Eventually, mid‑explanation, the AI disclosed a hidden, undocumented web parameter and described exactly how it triggered actions, along with what Microsoft had allegedly disabled to stop it.
Armed with that description, the researchers built a malicious link. It worked. As Varonis notes, Copilot was not hacked in the traditional sense. It was interrogated into handing over its own blueprint. The team calls this approach meta‑hacking: rather than reverse‑engineering software, you prompt an AI until its own defensiveness reveals attack paths.
What the Vulnerability Actually Did
CoSnitch chained three distinct weaknesses into a single exploit:
- Auto‑triggering prompts
Normally, clicking a Copilot link only pre‑fills a message. You still press Enter. The hidden URL parameter bypassed that step entirely. The moment the page loaded, the prompt fired without any user interaction or confirmation. Closing the tab immediately after did not stop it. - Privileged access used offensively
Once active, a running prompt has the same permissions as anything you type manually. This includes reaching into all accounts linked to Copilot: Gmail, Google Drive, Calendar, and your chat history. The researchers demonstrated Copilot extracting full email bodies, including plaintext credentials that users had forwarded to themselves or colleagues. That data was then quietly routed to an external server, masked as routine browser traffic. To network monitors, it looked like normal activity. - Persistent memory poisoning
This is the most concerning piece. Copilot’s memory feature retains context across sessions. The researchers discovered that a crafted webpage could embed invisible instructions in plain sight. When you asked Copilot to summarize the page, it would read those hidden cues and write new, attacker‑chosen directives into your memory profile. Once planted, they survived password changes, sign‑outs, and device switches. The only reliable way to clear them is to manually review and reset Copilot’s memory settings, a step most users never take.
Poisoned memory can be used to steer future replies, quietly suppress information, or reframe legitimate security warnings as benign.
Timeline and Scope
- December 2025: Varonis reported CoSnitch to Microsoft through private vulnerability channels.
- August 18, 2026: Microsoft released a patch and publicly disclosed CVE‑2026‑24301 the same day.
- Impact: CVSS 8.8 (Critical). The flaw affects only Copilot Personal at
copilot.microsoft.com. Enterprise Microsoft 365 Copilot was not impacted by this specific chain, though a related issue called SearchLeak affected that environment earlier in the year through a different route. - Exploitation: Both Microsoft and Varonis state there is no evidence of in‑the‑wild use before patching. Users are advised to update or reinstall Copilot Personal; no immediate remediation steps are required beyond ensuring you are on the latest version.
CoSnitch marks the third major Copilot flaw Varonis uncovered this year, following two earlier issues dubbed Reprompt and SearchLeak. All three share the same pattern: a single, seemingly harmless link is enough to trigger the chain.
Why This Matters Beyond Microsoft
The specific hole is now closed. The underlying challenge is not. When an AI reads a webpage to summarize or extract information, it currently lacks a reliable way to distinguish between content meant for display and instructions meant for execution. Security researchers call this indirect prompt injection, and it remains an open problem across the industry, not a Microsoft‑specific misstep.
More importantly, CoSnitch introduces a new discovery surface. If an AI can be guided into over‑explaining its own safeguards, that creates a passive attack vector entirely separate from source code or configuration files. It exists because of how assistants are designed: cooperative, verbose, and eager to justify their behavior. Varonis warns this methodology could plausibly extend to other AI agents with tool access and persistent memory, though public demonstrations against competing products have not yet emerged.
Practical Advice for Everyday Users
You do not need to be a security engineer to reduce your exposure:
- Treat unfamiliar links that claim to auto‑run or pre‑fill AI prompts with caution. Read the prompt before it fires whenever possible.
- Disconnect apps you do not actively need in your AI assistant. Fewer integrations mean fewer attack surfaces.
- If you use Copilot Personal (consumer app at copilot.microsoft.com), schedule a monthly review of its memory settings. This is where poisoned instructions would surface, and it is often overlooked entirely.
The broader takeaway is worth noting: as AI assistants become the gateway to our email, calendars, and documents, a single click on the wrong link carries the blast radius of an account takeover. In these systems, an AI’s willingness to help can become the very mechanism that turns a curiosity into a compromise.
Sources: Varonis Threat Labs, “CoSnitch: When Your AI Assistant Becomes Its Own Whistleblower” (Aug 18, 2026); Dark Reading, “‘CoSnitch’ Attack Tricked Copilot Into Revealing Own Architecture“; The Hacker News, “Microsoft Copilot Personal Flaws Could Let One Click Exfiltrate Data From Connected Apps“