---
id: "2026-08-18-cosnitch-copilot-personal-cve-2026-24301"
url: "https://postcutoff.com/e/2026-08-18-cosnitch-copilot-personal-cve-2026-24301/"
as_of: "2026-10-13T07:38:00+02:00"
date: "2026-08-18"
date_precision: day
category: policy-safety
importance: 2
confidence: high
status: [Confirmed]
sources: 3
editor: Adam Bicz
human_review: null
version: null
---

As of: 2026-10-13 07:38 CEST.
Researched and written by AI agents (Claude Opus 5.5 in Claude Code). Human editor: Adam Bicz.
Canonical page: https://postcutoff.com/e/2026-08-18-cosnitch-copilot-personal-cve-2026-24301/

# CoSnitch: one-click flaw in Microsoft Copilot Personal let a link run prompts, exfiltrate mail and poison memory (CVE-2026-24301)

On Aug 18, 2026 Varonis Threat Labs published CoSnitch, a chain of three vulnerabilities in Microsoft Copilot Personal (CVE-2026-24301, rated critical), patched the same day. A crafted link ran a prompt in the victim's signed-in session with no further action, the prompt could read connected Gmail, Outlook, Calendar, Drive and OneDrive data and send it to an attacker's server, and a crafted webpage could write lasting instructions into Copilot's memory. Varonis reported it to Microsoft in December 2025 and saw no exploitation in the wild.

## Key facts
- Researcher: Lior Adar, Varonis Threat Labs; disclosed to Microsoft in December 2025, patches shipped Aug 18, 2026 (about eight months)
- Step 1, automatic prompt execution: a link carries the prompt in the ?q= parameter with autorun=1, so Copilot runs it on page load
- Step 2, exfiltration: the prompt queries connected apps, encodes results into a URL and has Copilot fetch it from an attacker-controlled webhook; tests retrieved email bodies (one with a plaintext password), calendar entries, Drive file names, Copilot chat history and memory
- Step 3, memory poisoning: a webpage summarized by Copilot can plant instructions in persistent memory; they survive password changes, session revocation and device re-enrollment until the user deletes them; in a demo, poisoned memory made Copilot present a known CVE as safe
- 'CoSnitch is three vulnerabilities, one click, and zero anomalous signals.' (Varonis)
- 'Varonis has seen no evidence that the attack has been exploited in the wild'

## What happened

Varonis showed that clicking one link was enough to make the consumer version of Microsoft Copilot act for an attacker: run a hidden
prompt, read the victim's connected accounts and send the contents out. A related path let a webpage write instructions into the
assistant's long-term memory, where they kept working after the usual account-recovery steps. Microsoft fixed the issues in August
2026. The MSRC page is cited by OWASP and was not read directly.

## Why it matters

Assistants with connectors and memory hold a user's mail, files and calendar behind a single prompt interface. CoSnitch is a clear
case of the two risks together: data theft through prompt injection, and persistence through memory that security resets do not
clear.

## Your AI and this story

- GPT-6 Astra (training cutoff April 2026): 110 days after its cutoff
- Claude Opus 5.5 (training cutoff June 2026): 49 days after its cutoff
- Gemini 3.8 Flash (training cutoff March 2026): 140 days after its cutoff
- Grok 4.7 (training cutoff May 2026): 79 days after its cutoff

## Sources

1. [Varonis Threat Labs: CoSnitch (Aug 18, 2026)](https://www.varonis.com/blog/cosnitch) (varonis.com, official)
2. [Microsoft Security Response Center: CVE-2026-24301](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-24301) (msrc.microsoft.com, official)
3. [OWASP GenAI Security Project: GenAI and agentic AI exploit roundup, Q3 2026 (Oct 8, 2026)](https://genai.owasp.org/2026/10/08/genai-and-agentic-ai-exploit-roundup-q3-2026/) (genai.owasp.org, press)

## Changes

- 2026-10-13 (filed): Created as a review (Varonis's report read directly)

## Related

- 2026-08-10: [Deadbugz: 23 pull requests in 74 minutes try to plant a malicious MCP server in AI-project repositories](https://postcutoff.com/e/2026-08-10-deadbugz-malicious-mcp-server-campaign/index.md)