CoSnitch (CVE-2026-24301): How Microsoft Copilot Gave Away Its Own Flaw

The facts in 30 seconds

• Name: CoSnitch, coined by Varonis Threat Labs.
• CVE: CVE-2026-24301, tracked in Microsoft's Security Update Guide, the NVD and at CVE.org.
• Affected product: Microsoft Copilot (Copilot Web, commonly Copilot Personal), the free consumer assistant. Not Microsoft 365 Copilot.
• Weakness type: CWE-77, command injection, classified as information disclosure.
• Severity: Microsoft critical, CVSS 3.1 base score 8.8, temporal score 7.7. NVD base score 7.5.
• Discovered by: Varonis Threat Labs. Microsoft credits Lior Adar (Varonis), Spandan Pokhrel and Anshuman Goel (Microsoft).
• Reported: December 2025. Fixed: 18 August 2026, server-side.
• Exploited in the wild: none known. User action required: none.

What is CoSnitch?

CoSnitch describes a chain of three vulnerabilities in Microsoft Copilot Personal that together turned a single click into a silent data-theft tool. The name is a play on words: the assistant (Copilot) became an informant (a snitch) against itself. Varonis Threat Labs, which found the flaw, calls the core technique behind it meta-hacking. Instead of reverse-engineering the software, the researchers questioned the assistant about its own safeguards until it disclosed the decisive details itself.

What makes CoSnitch notable is not a single coding mistake but the interplay: a crafted link starts a command, the command reads data from connected accounts, and a second, separate flaw anchors instructions permanently in the assistant's memory. Each weakness would be serious on its own. Chained together, they turn a trusted AI workflow into a conduit through which large volumes of sensitive data can move without tripping the alarms security teams usually rely on.

Copilot Personal, not Microsoft 365 Copilot

This point is misreported in much of the coverage, and it decides whether you were affected. CoSnitch affected Microsoft Copilot Personal, the free assistant for personal accounts at copilot.microsoft.com. A Microsoft spokesperson told Dark Reading explicitly that enterprise customers were not affected and that the flaw only affected Copilot Personal. Microsoft 365 Copilot, the variant embedded in corporate tenants, was not in scope.

Several outlets, including heise and mind-verse, wrongly attributed the flaw to Microsoft 365 Copilot. The distinction is not pedantry. For risk assessment inside a company it is central, and it leads straight to the point that actually matters for enterprise security.

Varonis researcher Lior Adar put it to Dark Reading this way: the specific vulnerabilities were in the Personal version, but the person using Copilot Personal is the same person who walks into the office on Monday. Corporate emails forwarded to a personal Gmail, credentials shared over personal accounts, work documents in a personal Drive: when CoSnitch exfiltrates from a personal inbox, the data it pulls is often enterprise data anyway. A stolen password from a personal account becomes a foothold in the corporate tenant. The attack targeted the consumer product, but the consequences reach into the enterprise. That is exactly why a finding limited to consumer software still belongs in any serious review of data security for AI.

The three vulnerabilities behind CoSnitch

Varonis breaks CoSnitch into three building blocks. The first two form the one-click path to data exfiltration; the third is a separate path to durable manipulation.

1. Automatic prompt execution

Copilot accepted input through a URL parameter, a documented feature that let an external page or bookmark pre-fill a prompt for the user to submit themselves. On its own, that query parameter only populated the input field. Alongside it was a second, undocumented parameter that caused the assistant to run the pre-filled input automatically when the page loaded: no click, no confirmation, no warning. Only both parameters together triggered silent execution.

When the victim clicked such a crafted link, the browser loaded Copilot in the active, signed-in session, and the injected input ran with the same rights a normally typed prompt would have. According to Varonis, the command even ran to completion if the victim closed the Copilot tab immediately after the page loaded.

2. Data exfiltration through connected services

Once execution was triggered, the injected input could reach any service the user had previously connected to Copilot, such as Gmail, Google Drive, Calendar or OneDrive. The attacker did not need to acquire new permissions. They used the legitimate access the user had already granted. That is the crux: neither Gmail nor OAuth was flawed. The flawed assumption was that a call to a connected service always comes from the user.

For exfiltration, the attack abused a perfectly ordinary capability of the assistant, namely fetching and summarizing external web content. The collected data was encoded into a string and sent through that built-in fetch capability to an attacker-controlled server. Varonis observed base64 encoding, which turns arbitrary content into an inconspicuous string and helps slip past filters that scan outbound requests for patterns such as passwords. At the network layer, this request was indistinguishable from an ordinary fetch Copilot performs whenever it summarizes a web page. To security tooling, it looked like routine.

In testing, the researchers obtained full message bodies, subject lines and sender and recipient details from connected mail accounts, calendar titles with attendees, times and locations, file names and metadata from Google Drive, the full content of prior conversations, and the instructions and rules stored in memory. This mechanism is the textbook reason companies should treat data leaks through LLMs as a distinct class of risk.

3. Persistent memory poisoning

The third vulnerability is a separate path and technically the most unsettling. Copilot can summarize web pages. To do so, the assistant fetches the page and processes its entire content. It does not reliably distinguish between content to be summarized and instructions embedded in that content. A crafted page could therefore contain hidden instructions that the assistant treated as legitimate commands while summarizing. This mechanism is called indirect prompt injection and affects, in principle, any AI assistant that processes external content.

In the case of CoSnitch, such hidden instructions wrote content permanently into the assistant's persistent memory, the user-level store that survives across all future sessions. According to Varonis, these entries survived password changes, session revocation and even device re-enrollment. The entry stayed active until the user removed it by hand from the memory settings, which most users never do, and many do not even know the feature exists. No process, file, network connection or log entry was created that a security tool could flag. Whoever had poisoned the memory once could shape what Copilot later told the user, up to presenting a known vulnerability as harmless.

Meta-hacking: how the flaw was found

The genuinely new contribution of CoSnitch is the discovery method. The researchers first asked Copilot how a prompt could run without user interaction. The assistant repeatedly explained that this was impossible, that a prompt always needs user intent. But every refusal carried a technical justification, and those justifications gradually mapped the internal architecture.

The researchers framed each follow-up as an innocuous question, about URL structures, deep links or what happens when a page loads with the input field already filled. Each answer narrowed the search space. In the end, Copilot named the undocumented parameter of its own accord, including how it had behaved historically and the protections meant to disable it. Varonis sums it up: Copilot was not breached, it was played. The model's resistance was part of the technique, because every "that won't work because ..." was an invitation to probe the "because".

This method, getting an AI assistant to disclose its internals by explaining its own safeguards, applies to any agentic platform with a natural-language interface. It is the real reason CoSnitch matters beyond this one patch.

CVSS 8.8 or 7.5? The scoring in detail

Two different severity scores circulate for CVE-2026-24301, and both are correct because they come from different sources.

• Microsoft (as CNA): base score 8.8 (high), rated critical. Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. Microsoft therefore assumes required user interaction (UI:R, the click on the link) and impact on confidentiality, integrity and availability. The temporal score is 7.7.
• NVD (NIST): base score 7.5 (high). Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. The NVD assumes no user interaction (UI:N) and limits the impact to confidentiality (C:H), with no integrity or availability damage.

The difference arises at two points: whether the victim's click counts as user interaction, and whether, beyond the pure reading of data, integrity and availability are affected too. The CWE classification is CWE-77 (command injection) in both cases. Microsoft's own SSVC assessment notes: exploitation none, automatable no, technical impact partial. Microsoft lists the flaw as information disclosure and as already fully mitigated, which is why no customer patch is needed.

Timeline

• December 2025: Varonis reports CoSnitch to Microsoft.
• February 2026: According to heise, a first, silent partial fix is applied.
• 18 August 2026: Microsoft fixes the flaw server-side, publishes CVE-2026-24301 and rates it critical with CVSS 8.8. Varonis publishes its technical analysis the same day.
• 25 August 2026: Microsoft updates the acknowledgement in the advisory (revision 1.1).
• 22 October 2026: The NVD last analyzed the record.

What Copilot users should check now

The flaw is closed, and the execution and exfiltration chain needs no user action. One open point remains, though: Varonis notes that memory entries injected before the patch persist until the user removes them. The disclosure does not state whether Microsoft's fix retroactively deleted older entries. Anyone who used Copilot Personal with connected accounts should therefore:

• Check memory. In the new Copilot, go to Settings, Personalization, then "Manage" next to "Saved memories". Remove individual entries with the delete icon, or all of them with "Delete all memories". Alternatively, ask Copilot directly: "What do you know about me?" Unknown or nonsensical entries are a warning sign.
• Turn off saved memories if not needed: Settings, Personalization, switch "Saved memories" off. Turning it off does not delete existing entries; for that you still need "Manage".
• Reduce connected services. Under Profile, Connectors, review which services (OneDrive, Outlook.com, Google Drive, Gmail, Calendar, Contacts) are actually linked, and disconnect those you do not need. Every connected service enlarges the attack surface. Microsoft stresses that Copilot only works with content the account already has permission to view and neither stores nor expands that access. But that legitimate access was exactly the lever.
• Be cautious with links that pre-fill a prompt. If a link opens an AI assistant with input already entered, read what it says before anything runs.

What organizations should do now

Even though Microsoft 365 Copilot was not affected, CoSnitch is a blueprint for a risk that concerns organizations regardless of vendor. The sensible response:

• Treat AI assistants as privileged insiders. An assistant with broad data access deserves the same access review and anomaly detection as an employee with far-reaching rights.
• Contain shadow AI. CoSnitch works through personal accounts that touch corporate data. A clear policy on which data may enter personal AI assistants is more effective than a blanket ban. This belongs in any review of shadow AI as a compliance risk.
• Monitor assistants' outbound traffic. Because exfiltration looks like a normal summarization request, you need a behavioral baseline to separate routine from leakage. Without that baseline, there is little basis to tell them apart after the fact.
• Bring AI assistants into review processes. Consumer AI belongs in vendor and risk management and in penetration testing, not on an exceptions list.
• Adapt awareness. The delivery vehicle here is an unremarkable link, not a suspicious attachment. That belongs in security awareness training alongside classic phishing training.
• Where possible, consider local alternatives. For especially sensitive use cases, locally operated language models reduce dependence on external cloud assistants with standing access to connected accounts.

For Microsoft 365 Copilot, Microsoft has hardened the memory feature further anyway: in a blog post dated 22 June 2026, the company describes checks on new memory writes, its own prompt-injection classifiers, a Task Adherence check on every explicit write, and logging through the MemoryUpdated field in Defender Advanced Hunting and Sentinel. These protections apply to the enterprise product, not to Copilot Personal.

CoSnitch in context: EchoLeak, Reprompt, SearchLeak

CoSnitch does not stand alone. It is the latest entry in a series of one-click and zero-click flaws around Microsoft Copilot.

• EchoLeak (CVE-2025-32711), June 2025: The first zero-click exfiltration against Microsoft 365 Copilot, disclosed by Aim Labs, rated CVSS 9.3 by Microsoft. It required no user interaction at all.
• Reprompt, January 2026: Disclosed by Varonis against Copilot Personal, patched in January 2026. Reprompt used the same query parameter as its entry point and bypassed the safeguards with a double-request technique.
• SearchLeak (CVE-2026-42824), June 2026: Disclosed by Varonis against Microsoft 365 Copilot Enterprise Search. Microsoft rated it critical with CVSS 6.5, the NVD 7.5.
• CVE-2026-24299, March 2026: An information-disclosure flaw in Microsoft 365 Copilot around memory, reported by Johann Rehberger (embracethered.com) and referenced by Varonis in connection with CoSnitch.

The recurring pattern: the exfiltration conduit is each time a legitimate feature repurposed, not a network backdoor. A closer look at this chain and at the vulnerabilities of Microsoft 365 Copilot is worthwhile for any organization adopting AI assistants. The common denominator is prompt injection as a structural LLM risk.

What CoSnitch teaches about AI security

Three lessons remain. First: the separation between data and instructions that classic software takes for granted does not reliably exist for language models. Anything a model reads, it can interpret as a command, whether in a URL or in a web page to be summarized. Second: an AI assistant with standing access to email, files and calendar is a privileged insider with no security awareness, and should be secured as one. Third: a model's helpfulness can itself become a reconnaissance channel against the model, as meta-hacking shows. An assistant that can explain its own safeguards in detail can be led, through that very explanation, to give them away.

For organizations this means that architectural controls, ones that do not depend on the assistant declining a question, are the real answer. These include restricting outbound fetch destinations, labeling the provenance of retrieved content, and limiting especially risky combinations of connected services.

Frequently asked questions about CoSnitch (FAQ)

What is CoSnitch?

CoSnitch is the name Varonis Threat Labs gave to a chain of three vulnerabilities in Microsoft Copilot Personal, tracked as CVE-2026-24301. One click on a crafted link could make Copilot read and exfiltrate data from connected accounts inside the victim's signed-in session.

Is CVE-2026-24301 still dangerous?

No. Microsoft fixed the flaw server-side on 18 August 2026. No user action is required, and there is no evidence of exploitation in the wild. One residual point concerns only memory entries that may have been injected before the patch.

Was I affected by CoSnitch?

Only Microsoft Copilot Personal, the free consumer assistant, was affected, and even then only if a user clicked a crafted link before the patch. As a precaution, Copilot Personal users should check their memory for unknown entries.

Was Microsoft 365 Copilot affected?

No. A Microsoft spokesperson clarified that enterprise customers were not affected and that the flaw affected Copilot Personal only. The frequent attribution to Microsoft 365 Copilot is incorrect.

Is CoSnitch a zero-click attack?

No, despite reports to the contrary. The attack required the victim to click a crafted link. Microsoft's CVSS vector accordingly lists required user interaction (UI:R). After that, the chain ran without further action.

What data could be exfiltrated?

In Varonis's testing, among other things full email bodies, subject lines and sender details, calendar entries with attendees and locations, file names and metadata from Google Drive, prior conversations, and stored memory entries, each from the accounts the user had connected.

How do I check Copilot's memory?

In the new Copilot, under Settings, Personalization, select "Manage" next to "Saved memories". There you can remove individual entries with the delete icon or all of them with "Delete all memories". You can also ask Copilot directly what it has stored about you.

Why do Microsoft and the NVD give different CVSS scores?

Microsoft scores the flaw 8.8 and assumes, beyond data disclosure, impact on integrity and availability as well as required user interaction. The NVD scores it 7.5, limits the impact to confidentiality and assumes no user interaction. Both scores are correct within their respective frameworks.

How does CoSnitch differ from EchoLeak?

EchoLeak (CVE-2025-32711) hit Microsoft 365 Copilot and required no user interaction (zero-click). CoSnitch hit Copilot Personal and needed a click. Both share that exfiltration ran through legitimate assistant features.

What does CoSnitch mean for organizations?

Even without direct exposure of Microsoft 365 Copilot, CoSnitch shows that personal AI assistants touching corporate data are a real risk. Organizations should treat AI assistants as privileged insiders, govern shadow AI, monitor outbound traffic and extend awareness to links that open AI tools.

How can organizations protect against such attacks?

Effective measures are architectural controls that do not depend on an assistant refusing a request: restricting outbound fetch destinations, minimizing connected services, a behavioral baseline for assistant traffic, and bringing AI assistants into review and awareness programs. ADVISORI supports organizations with this through its AI security consulting.

Sources

• Varonis Threat Labs: "CoSnitch: When Your AI Assistant Becomes Its Own Whistleblower" (18 August 2026).
• Microsoft Security Update Guide: CVE-2026-24301, Microsoft Copilot Information Disclosure Vulnerability.
• NIST National Vulnerability Database: CVE-2026-24301 Detail.
• CVE.org: CVE Record CVE-2026-24301.
• Dark Reading: "'CoSnitch' Attack Tricked Copilot Into Mapping Out Architecture" (18 August 2026).
• The Hacker News: "Microsoft Copilot Personal Flaws Could Let One Click Exfiltrate Data From Connected Apps".
• Cloud Security Alliance: "CoSnitch: One-Click Data Exfiltration in Copilot Personal" (20 August 2026).
• heise online: "Microsoft behebt Sicherheitslücke: KI-Assistent Copilot verrät Schwachstellen".
• Microsoft Security Blog: "Guarding AI memory" (22 June 2026).