Varonis Threat Labs has disclosed three vulnerabilities in Microsoft Copilot Personal that it said could allow a single click on a crafted link to silently pull data from connected apps and other information available to the victim’s Copilot session.
The flaws, which the researchers collectively named CoSnitch, turn in part on an undocumented URL parameter that the assistant itself surfaced during testing.
The company said it reported the issue to Microsoft in December 2025 and that patches shipped on August 18, 2026.
CoSnitch is tracked as CVE-2026-24301 in Microsoft’s Security Update Guide. The research names Copilot Personal, the consumer assistant hosted at copilot.microsoft.com, and does not state that the same behavior affected Microsoft 365 Copilot.
The researchers said they found no evidence that CoSnitch was exploited in the wild. They reached the parameter by repeatedly asking Copilot why a prompt could not be made to run without user interaction, an approach the firm calls meta-hacking. Each refusal carried a technical justification, and the assistant eventually named a parameter, autorun=1, along with the session conditions under which it worked and the protections that were supposed to have disabled it.
When the researchers built the URL exactly as described, the parameter Copilot had said no longer worked executed. Copilot “wasn’t breached; it was played,” Varonis said in its report.
The attack URL pairs autorun=1 with the existing q parameter. In the CoSnitch report, Varonis said q alone only pre-fills the input box and that both parameters must be present for the prompt to fire without a user gesture.
Its earlier Reprompt research also used q as the Parameter-to-Prompt entry point in a one-click attack. Varonis said that once CoSnitch execution begins, the prompt runs to completion even if the victim closes the Copilot tab immediately after the page loads.
Varonis grouped the findings into three vulnerabilities. The first two form the one-click exfiltration path, while the third is a separate memory-poisoning path triggered through web summarization:
- Automatic prompt execution. The two parameters together cause an attacker-supplied prompt to run on page load inside the victim’s authenticated session, with the same capabilities as an instruction the user typed.
- Exfiltration through connected services. The injected prompt can query services the user has already authorized, encode retrieved data, and use Copilot’s built-in URL fetch to send it to an attacker-controlled webhook. The technique does not grant Copilot new provider permissions or expand the user’s existing access.
- Persistent memory writes from summarized pages. Separately, a crafted web page, when summarized by Copilot, can cause the assistant to write attacker instructions into the user’s memory store, where they can shape later sessions.
In testing, the researchers said Copilot returned message bodies, subject lines, and sender and recipient metadata from connected mail accounts, calendar titles, attendees, times, and locations, file names and metadata summaries from Google Drive, full prior conversation content from chat history, and the saved instructions and user-defined rules held in the memory store.
Microsoft’s connector documentation says users must authorize services before Copilot can access them and that connected services process requests using the user’s existing permissions. Microsoft says Copilot does not expand that access and only works with content the account already has permission to view.
Varonis said the exfiltration request is indistinguishable at the network layer from the fetches Copilot performs when it summarizes an ordinary web page, and that base64 encoding can help avoid filters scanning outbound requests for sensitive patterns such as credentials.
On the separate memory path, the firm said an injected instruction survives password changes, session revocation, and device re-enrollment, and stays active in later conversations until the user deletes it from Copilot’s memory settings.
Varonis also said the memory write produces no process, file, network connection, or log entry that security tooling would flag, with the change visible in Copilot’s memory interface.
The web summarization path is not the first time Copilot memory has been reported to Microsoft. Researcher Håkon Måløy documented an attacker-controlled page that persisted an unintended memory when a victim used a Microsoft 365 Copilot summarization flow, publishing on June 22, 2026 after a 90-day coordination period and recording the Microsoft-side status as “mitigated globally.”
Johann Rehberger separately reported memory writes and deletions through indirect prompt injection in Microsoft 365 Copilot, as well as memory modification in the consumer assistant, in research associated with CVE-2026-24299.
Microsoft set out its own position on the same class of attack in a June 22 security blog post that credited MSRC cases from Rehberger, Måløy, and Gal Zror. Scoped to Microsoft 365 rather than the consumer product, the company said memories pass through sanitization and prompt-injection checks on write, that M365 Copilot is designed to run Task Adherence checks on every explicit memory write, and that memory updates are recorded to organizational audit logs and surfaced to analysts through a MemoryUpdated field in Defender Advanced Hunting and Sentinel.
Varonis advised reviewing which apps are connected to Copilot and disconnecting those not actively needed, treating the assistant as a privileged insider for access review and anomaly detection, and exercising caution with links that open AI assistants.
The company did not identify a client update that users need to install. Varonis said injected memories persist until explicitly removed; its disclosure does not state whether Microsoft’s remediation retroactively removed memory entries created before the fix.
The disclosure comes less than two weeks after the same team detailed RovoBlast, a one-click attack on Atlassian’s Rovo assistant that abused the rovoChatPrompt URL parameter to seed attacker-controlled instructions into a signed-in user’s session. Varonis said Atlassian fixed the issue before its public disclosure.
