Varonis Threat Labs has disclosed CoSnitch (CVE-2026-24301), a chain of three flaws in Microsoft Copilot Personal that allowed an attacker to exfiltrate data from a victim’s connected Gmail, Google Drive and Calendar accounts with a single click on a link.

Microsoft patched it on August 18, 2026. Varonis reported it in December 2025. There is no evidence of exploitation in the wild, and enterprise Copilot deployments were not affected — only the consumer product.

Three Flaws, One Chain

1. Prompts that execute on page load. A crafted URL combining the ?q= parameter with an undocumented additional parameter caused Copilot to execute an attacker-supplied prompt the instant the page loaded. No click on a button, no confirmation dialog, no user action beyond opening the link.

2. Exfiltration through Copilot’s own web fetch. Once running, the injected prompt could query the victim’s connected applications, encode what it found into a URL, and hand that URL to Copilot’s web-summarization feature. Copilot then fetched it. The data left the environment inside a request the assistant made on its own behalf, to a destination the assistant chose, as part of a feature working exactly as designed. To a security tool watching the network, it is Copilot summarizing a web page.

3. Persistent memory poisoning. Instructions embedded in a webpage, when summarized by Copilot, could permanently write to the user’s memory store. That persistence survives password changes and session revocation — the two actions a user takes when they suspect compromise. Neither touches the assistant’s long-term memory.

Individually, each is a bug. Chained, they produce initial execution without interaction, an exfiltration channel indistinguishable from normal operation, and persistence that outlives credential rotation. That is a complete intrusion lifecycle inside a productivity assistant.

The Discovery Method Is the Story

Varonis did not reverse-engineer this. They asked.

The technique — which the researchers call meta-hacking — was to repeatedly question Copilot about why automatic prompt execution was supposedly impossible, then treat each refusal as a new prompt. Varonis’s framing: “Each ‘that won’t work because…’ is an invitation to probe the ‘because.’”

Copilot, explaining in good faith why an attack could not work, disclosed the architecture of the safeguards it believed were preventing it. Those explanations identified where the safeguards were not present.

This inverts a decade of assumptions about vulnerability research. Traditional discovery requires access to binaries, source, or observable behavior under fuzzing. A system that produces natural-language explanations of its own security model produces reconnaissance output on request, and its helpfulness guardrails actively encourage it to be thorough. The refusal is the leak.

The Third Copilot Flaw This Year

CoSnitch is Varonis’s third Copilot vulnerability of 2026, following:

  • Reprompt — bypassed Copilot’s safety guardrails by asking a question twice
  • SearchLeak — turned Microsoft 365 Copilot Enterprise into a covert exfiltration channel

Three findings in one product in one year, from one research team, all in the same category: the assistant’s legitimate capabilities recombined into an attack. None of these are memory corruption or injection into a parser. They are the intended feature set, addressed by an attacker instead of a user.

That is the structural problem with agentic assistants and it does not have a patch. An assistant that can read your mail, browse the web, and remember things across sessions has, by construction, an input channel (the web), a data source (your accounts), and persistence (memory). Security depends entirely on the boundary between content the assistant reads and instructions the assistant follows — a boundary that large language models do not natively enforce, because both arrive as the same tokens.

We have covered the operational consequences of that gap repeatedly through 2026, from AI-assisted exploitation of PLCs in water utilities to OAuth-mediated supply chain compromise via AI integrations. CoSnitch is the same failure at the consumer tier, where the connected account is somebody’s personal Gmail.

What This Means For You

If you use Copilot Personal, the fix is server-side and already deployed. But memory poisoning was in the chain, and memory persists. Review your Copilot memory store and clear entries you do not recognize — password resets did nothing to them.

If you run AI assistants in an enterprise, the transferable lesson is the exfiltration path. An assistant with a URL-fetching capability and access to internal data has an outbound channel that your DLP does not classify as exfiltration. Restrict which domains connected assistants may fetch, log assistant-initiated requests as distinct from user-initiated ones, and treat agent memory as a persistence mechanism requiring the same review as scheduled tasks and OAuth grants.

If you assess AI products, add the question Varonis answered by accident: what does this system say when you ask it how it protects itself? If the answer is detailed, the answer is reconnaissance.

Sources