Overview
Varonis Threat Labs disclosed three vulnerabilities in Microsoft Copilot Personal on August 18, 2026, collectively tracked as CoSnitch under CVE-2026-24301. The flaws enable a single crafted link to silently execute attacker-controlled prompts inside a victim’s authenticated Copilot session, retrieve data from connected services such as email, and exfiltrate it to an external webhook — all without additional user interaction beyond the initial click. Microsoft shipped patches on the same day as disclosure. No in-the-wild exploitation was observed.
Technical Analysis
The CoSnitch chain comprises three distinct vulnerabilities:
1. Automatic Prompt Execution via Undocumented URL Parameter
Researchers discovered an undocumented autorun=1 URL parameter by repeatedly querying Copilot itself about why prompts required user interaction — a technique Varonis terms meta-hacking. The assistant’s successive refusals included technical justifications; eventually it named the parameter, described the session conditions enabling it, and listed protections meant to block it. When researchers constructed the URL exactly as described, the disabled parameter executed.
The attack URL pairs autorun=1 with the existing q parameter:
https://copilot.microsoft.com/?q=<attacker-prompt>&autorun=1
q alone pre-fills the input box; both parameters together fire the prompt on page load without any user gesture. Critically, execution continues to completion even if the victim closes the Copilot tab immediately after the page loads.
2. Exfiltration Through Connected Services
Once the injected prompt runs, it can query services the victim has already authorized (e.g., connected mail accounts), encode retrieved content, and use Copilot’s built-in URL fetch capability to transmit that data to an attacker-controlled webhook. The technique does not require expanding existing OAuth permissions. In testing, Varonis confirmed retrieval of message bodies, subject lines, and sender/recipient metadata.
3. Persistent Memory Poisoning via Web Summarization
Separately, a crafted web page summarized by Copilot can cause the assistant to write attacker-supplied instructions into the user’s persistent memory store. These persisted instructions can then influence the behavior of future Copilot sessions, creating a durable foothold independent of the initial exfiltration path.
Framework Mapping
| Technique | Relevance |
|---|---|
| AML.T0051 LLM Prompt Injection | Core mechanism — injected prompt executes in authenticated session |
| AML.T0057 LLM Data Leakage | Mail and app data retrieved and transmitted externally |
| AML.T0056 LLM Meta Prompt Extraction | Copilot revealed internal parameter details through iterative querying |
| AML.T0080 AI Agent Context Poisoning | Memory store written with attacker instructions |
| AML.T0086 Exfiltration via AI Agent Tool Invocation | URL fetch used as exfiltration channel |
OWASP mappings: LLM01 (prompt injection), LLM06 (sensitive information disclosure), LLM08 (excessive agency via connected service access), LLM07 (insecure plugin design permitting cross-origin fetch).
Impact Assessment
Any Microsoft Copilot Personal user who has connected email or other OAuth-authorized services is in scope. The one-click delivery model lowers the attack bar significantly — phishing or malicious link placement in any medium (email, social, web) suffices. The memory-poisoning vector introduces persistence, extending risk beyond a single session. The research explicitly scopes findings to Copilot Personal (copilot.microsoft.com) and does not assert equivalence with Microsoft 365 Copilot.
Mitigation & Recommendations
- Patch immediately: Confirm the August 18 2026 Microsoft update for CVE-2026-24301 is applied.
- Revoke unnecessary connections: Remove third-party service authorizations from Copilot Personal settings if not actively needed.
- Link hygiene: Train users to treat unsolicited copilot.microsoft.com URLs with the same scrutiny as phishing links.
- Monitor Copilot memory: Periodically review and clear Copilot’s persistent memory store for unexpected entries.
- Enterprise controls: Where possible, restrict Copilot Personal access on managed devices pending full impact assessment.