CoSnitch: one-click flaw in Microsoft Copilot Personal let a link run prompts, exfiltrate mail and poison memory (CVE-2026-24301)
Confirmed
The takeaway
On Aug 18, 2026 Varonis Threat Labs published CoSnitch, a chain of three vulnerabilities in Microsoft Copilot Personal (CVE-2026-24301, rated critical), patched the same day.
Status
- Claim
Confirmed
- Our reporting
- High confidence
- Importance
- 2 of 5
- Last verified
- 13 October 2026
Your AI and this story
- GPT-6 Astra110 days after its cutoff
- Claude Opus 5.549 days after its cutoff
- Gemini 3.8 Flash140 days after its cutoff
- Grok 4.779 days after its cutoff
None of these four assistants can know about it. The closest, Claude Opus 5.5, stops 49 days before it.
Key facts
- Researcher: Lior Adar, Varonis Threat Labs; disclosed to Microsoft in December 2025, patches shipped Aug 18, 2026 (about eight months)
- Step 1, automatic prompt execution: a link carries the prompt in the ?q= parameter with autorun=1, so Copilot runs it on page load
- Step 2, exfiltration: the prompt queries connected apps, encodes results into a URL and has Copilot fetch it from an attacker-controlled webhook; tests retrieved email bodies (one with a plaintext password), calendar entries, Drive file names, Copilot chat history and memory
- Step 3, memory poisoning: a webpage summarized by Copilot can plant instructions in persistent memory; they survive password changes, session revocation and device re-enrollment until the user deletes them; in a demo, poisoned memory made Copilot present a known CVE as safe
- ‘CoSnitch is three vulnerabilities, one click, and zero anomalous signals.’ (Varonis)
- ‘Varonis has seen no evidence that the attack has been exploited in the wild’
What happened
Varonis showed that clicking one link was enough to make the consumer version of Microsoft Copilot act for an attacker: run a hidden prompt, read the victim’s connected accounts and send the contents out. A related path let a webpage write instructions into the assistant’s long-term memory, where they kept working after the usual account-recovery steps. Microsoft fixed the issues in August 2026. The MSRC page is cited by OWASP and was not read directly.
Why it matters
Assistants with connectors and memory hold a user’s mail, files and calendar behind a single prompt interface. CoSnitch is a clear case of the two risks together: data theft through prompt injection, and persistence through memory that security resets do not clear.
Sources
3 sources from 3 sites. Numbers match the chips in the text.
3 sources: 2 primary, 1 press
Primary
- Varonis Threat Labs: CoSnitch (Aug 18, 2026)varonis.com, official
- Microsoft Security Response Center: CVE-2026-24301msrc.microsoft.com, official
Press
Changes
- Filed as a review (Varonis’s report read directly)