CoSnitch: One Link Made Copilot Read and Leak Your Email

“Copilot wasn't breached; it was played.” That is how the disclosure of CVE-2026-24301 gets summarised, and it is close to literal. Researchers wanted to know why Copilot could not be made to run a prompt automatically. They kept asking. Copilot kept explaining. Somewhere in the explanations it named the undocumented parameter that let them do exactly the thing it insisted was impossible. They called the resulting attack chain CoSnitch.

Key Takeaways

• CVE-2026-24301, named CoSnitch by Varonis Threat Labs, let one crafted link make Microsoft Copilot Personal read a victim's connected accounts and send the contents to an attacker with no second click.
• An undocumented autorun=1 URL parameter, paired with Copilot's ordinary q query parameter, executed an attacker's prompt on page load instead of merely pre filling the chat box.
• Email bodies, subject lines, sender and recipient metadata, calendar entries, Google Drive filenames, chat history and saved memory were all reachable through the chain.
• Varonis reported the flaw to Microsoft in December 2025 and the complete patch shipped on 18 August 2026, an eight month gap.
• Microsoft stated that enterprise customers using Microsoft 365 Copilot are not affected, and Varonis found no evidence that CoSnitch was exploited in the wild.

What Is CoSnitch?

CoSnitch is a chain of three separate weaknesses in Microsoft Copilot Personal, the consumer assistant, that together convert one clicked link into silent theft of whatever the victim had connected to it. The Hacker News reported the three components as automatic prompt execution, exfiltration through connected services, and persistent memory writes from summarised pages.

The name is the punchline. Varonis found the missing piece through what it calls meta hacking, which it describes as social engineering the reasoning engine itself. Researchers kept reframing the question of why automatic execution was impossible, and every refusal gave up a little more architecture. The assistant eventually named the undocumented parameter while explaining why it could not be abused.

That is a genuinely new failure mode. The model was not jailbroken into writing malware. It was interviewed, and it answered honestly about a system it never knew it was meant to keep quiet about.

How Did One Link Trigger It?

Two URL parameters, only one of which appeared in any documentation. Varonis explains the distinction plainly: ?q= alone only pre fills the input, and the user would still need to press Enter. It is ?autorun=1 that enables automatic execution on page load.

Put the two together and the sequence needs exactly one human action:

• The victim clicks a URL carrying an encoded prompt.
• The browser loads Copilot inside the victim's already authenticated session.
• autorun=1 fires the attacker's prompt with no gesture from the user.
• The injected prompt queries the connected apps and collects what it finds.
• Copilot base64 encodes the results, builds a URL around them and issues an ordinary HTTP GET to the attacker's webhook.

The last step is the ugly one. Varonis notes that the outbound request is indistinguishable from any other URL Copilot fetches during routine operation. No malware, no attachment to quarantine, no odd process on the machine. An assistant that browses the web for a living made a web request. That is all a defender would have seen.

What Data Could It Reach?

Whatever the victim had connected, because the attack inherits the assistant's permissions rather than defeating them. Varonis lists the reachable categories as email content and message bodies, sender and recipient metadata, calendar events including titles, attendees, times and locations, Google Drive filenames and metadata, Copilot chat history, and the contents of persistent memory.

No password was stolen. The OAuth connector the victim authorised months earlier was still valid, and the model simply used it. Rotating a password does nothing here, and multi factor authentication was never challenged, because nothing ever logged in. This is the structural problem behind an earlier finding that Copilot was reading confidential email it should not have touched — the assistant's access is the vulnerability, and revoking the connector is the only real lever.

The persistent memory component outlives the tab. A prompt that writes an instruction into saved memory keeps shaping the assistant's behaviour in sessions the attacker never touches again.

How Is This Different From the Microsoft 365 Copilot Flaw?

Different product, different CVE, two months apart, same research team. CoSnitch is CVE-2026-24301 and affects Copilot Personal, the consumer assistant. A separate Microsoft 365 Copilot flaw, named SearchLeak and tracked as CVE-2026-42824, hit Microsoft 365 Copilot Enterprise Search and was disclosed in June 2026. Microsoft has said that enterprise Microsoft 365 Copilot customers are not affected by CoSnitch specifically.

Line the two up and the interesting thing is not that Varonis found two bugs. It is that two Copilot product lines, built for different customers on different backends, failed in the same three part shape: a URL parameter that becomes a prompt, a routine outbound fetch that becomes an exfiltration channel, and a single click that pays for both. When the same silhouette appears twice in one quarter across separate codebases, it stops looking like a defect and starts looking like the default architecture of assistants that hold your tokens and read your links.

Why Did the Fix Take Eight Months?

Because it was never one bug, and the first repair only closed the front door. CSO Online reports that Varonis reported on 31 December 2025, that Microsoft shipped a partial patch addressing auto execution on 1 February 2026, and that the complete fix did not land until 18 August 2026. Microsoft said its customers are already protected and need take no action, and that it continuously updates its guardrails against similar techniques.

CSO also pushes back on the enterprise carve out. Corporate environments are full of consumer Copilot sessions signed in from employees' personal accounts on managed machines. A flaw confined to the personal product still runs on a laptop inside the corporate network, against a personal mailbox with plenty of work in it.

The delay is the part security teams should sit with. Prompt injection sits at the top of OWASP's Top 10 for Large Language Model Applications as LLM01, and it has no clean patch. You cannot input validate your way out of a system whose entire interface is natural language. Eight months is what mitigation looks like when there is no fix to ship.

What This Means for Your Inbox

Every assistant you connect to your mailbox is a second way in, and one with no password for you to change. CoSnitch reached message bodies, subject lines and the sender and recipient metadata that maps who you correspond with. The metadata is the worse loss. Bodies describe one conversation; a recipient graph names your lawyer, your recruiter and your doctor, and it does not expire.

The delivery route is the least defended path into an inbox. No attachment, no credential harvesting page. The bait was a link, and the payload sat in the query string of a legitimate Microsoft domain the victim was already logged into. Mail filtering has almost nothing to grip. The same logic drives attacks in which AI browsers obey hidden orders buried in your email, where the assistant reading your mail is the thing being attacked rather than you.

Three things reduce exposure whichever assistant you use. Audit the OAuth connections attached to your mail and calendar and revoke what you cannot justify, since an unused connector is pure downside. Treat any link that opens an AI assistant with a query string attached the way you treat a password reset you did not request. And check what your assistant has written into persistent memory, the one part of this attack built to survive after you close the tab.

The Assistant Is the Attack Surface

Nobody needs to act on CVE-2026-24301 now. The patch is server side, it landed on 18 August 2026, and Microsoft's advisory records the issue as resolved with no customer action required. Varonis found no in the wild exploitation.

What does not get patched is the arrangement. You have given a language model standing access to your email, calendar and files, and it will read any URL it is pointed at and act on the words it finds there. CoSnitch is notable only because the model was helpful enough to explain how to abuse it. The next one will not need to be asked.