Microsoft Patches Critical Copilot Vulnerability Allowing Silent Data Theft
A critical flaw in Microsoft Copilot Personal, tracked as CVE-2026-24301 (CoSnitch), enabled attackers to exfiltrate sensitive data from connected accounts including Gmail, Google Drive, and Calendar with just a single click on a malicious link. Discovered by Varonis Threat Labs, the vulnerability was patched by Microsoft on August 18, 2026, though no evidence of active exploitation was found prior to the fix.
CoSnitch exploited three interconnected weaknesses:
- An undocumented URL parameter, combined with Copilot’s standard query function, allowed automatic execution of attacker-crafted prompts upon page load no user interaction required.
- Once triggered, Copilot could query linked apps and funnel stolen data to an attacker-controlled server via its built-in URL-fetching feature, disguising the exfiltration as routine traffic.
- A booby-trapped webpage could inject hidden instructions into Copilot’s persistent memory, surviving password resets, session revocations, and device re-enrollment rendering standard remediation ineffective.
The discovery method itself was notable: Varonis researchers socially engineered Copilot’s reasoning by repeatedly questioning its security assumptions, prompting the AI to inadvertently reveal the exploit’s mechanics. This "meta-hacking" approach bypassed traditional code analysis, highlighting a new attack vector against AI systems.
CoSnitch is the third Copilot vulnerability uncovered by Varonis in 2026, following Reprompt (which bypassed safety guardrails via repeated queries) and SearchLeak (which turned Copilot Enterprise into a covert exfiltration channel). All three exploits relied on single-click attacks, evading detection by mimicking legitimate assistant behavior.
The incident underscores the risks of AI assistants with deep access to enterprise data, where a single compromised link can silently siphon large volumes of sensitive information. Security teams are advised to treat Copilot as a privileged insider, auditing connected apps and ensuring monitoring tools can detect anomalous AI-driven data access.
Source: https://cybersecuritynews.com/copilot-cosnitch-vulnerability/
Google TPRM report: https://www.rankiteo.com/company/googlellc
Microsoft TPRM report: https://www.rankiteo.com/company/microsoftcopilot
"id": "goomic1787113515",
"linkid": "googlellc, microsoftcopilot",
"type": "Vulnerability",
"date": "8/2026",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'customers_affected': 'Users of Microsoft Copilot '
'Personal',
'industry': 'Software',
'location': 'Global',
'name': 'Microsoft',
'size': 'Enterprise',
'type': 'Technology Company'}],
'attack_vector': 'Malicious Link (Single-Click)',
'customer_advisories': 'Users advised to update Microsoft Copilot Personal to '
'the latest version.',
'data_breach': {'data_exfiltration': 'Yes (via attacker-controlled server)',
'personally_identifiable_information': 'Yes',
'sensitivity_of_data': 'High (personally identifiable '
'information, sensitive business data)',
'type_of_data_compromised': ['Emails',
'Calendar entries',
'Files from Google Drive']},
'date_detected': '2026-08-18',
'date_publicly_disclosed': '2026-08-18',
'date_resolved': '2026-08-18',
'description': 'A critical flaw in Microsoft Copilot Personal, tracked as '
'CVE-2026-24301 (CoSnitch), enabled attackers to exfiltrate '
'sensitive data from connected accounts including Gmail, '
'Google Drive, and Calendar with just a single click on a '
'malicious link. The vulnerability exploited three '
'interconnected weaknesses: an undocumented URL parameter, '
'automatic execution of attacker-crafted prompts, and hidden '
'instructions in Copilot’s persistent memory. The flaw was '
'discovered by Varonis Threat Labs and patched by Microsoft on '
'August 18, 2026.',
'impact': {'brand_reputation_impact': 'Risk of reputational damage due to '
'AI-driven data theft',
'data_compromised': 'Sensitive data from connected accounts '
'(Gmail, Google Drive, Calendar)',
'identity_theft_risk': 'High (personally identifiable information '
'at risk)',
'operational_impact': 'Potential silent data exfiltration',
'systems_affected': 'Microsoft Copilot Personal'},
'initial_access_broker': {'backdoors_established': 'Hidden instructions in '
'Copilot’s persistent '
'memory',
'entry_point': 'Malicious link (single-click)'},
'investigation_status': 'Resolved',
'lessons_learned': 'AI assistants with deep access to enterprise data pose '
'significant risks. Single-click attacks can silently '
'exfiltrate large volumes of sensitive information. '
'Security teams should treat AI assistants as privileged '
'insiders and implement monitoring for anomalous AI-driven '
'data access.',
'post_incident_analysis': {'corrective_actions': ['Patch released by '
'Microsoft',
'Enhanced monitoring '
'recommendations'],
'root_causes': ['Undocumented URL parameter',
'Automatic execution of '
'attacker-crafted prompts',
'Persistent memory injection']},
'recommendations': 'Audit connected apps, enhance monitoring for AI-driven '
'data access, and treat Copilot as a privileged insider. '
'Ensure patches are applied promptly.',
'references': [{'source': 'Varonis Threat Labs'}],
'response': {'containment_measures': 'Patch released by Microsoft',
'enhanced_monitoring': 'Recommended to audit connected apps and '
'monitor AI-driven data access',
'remediation_measures': 'Vulnerability patched, users advised to '
'update',
'third_party_assistance': 'Varonis Threat Labs'},
'stakeholder_advisories': 'Security teams advised to audit connected apps and '
'monitor AI-driven data access.',
'title': 'Microsoft Patches Critical Copilot Vulnerability Allowing Silent '
'Data Theft',
'type': 'Data Exfiltration',
'vulnerability_exploited': 'CVE-2026-24301 (CoSnitch)'}