Microsoft Copilot Personal Flaws Could Let One Click Exfiltrate Data From Connected Apps
Varonis discloses CoSnitch (CVE-2026-24301), three Microsoft Copilot Personal flaws enabling one-click exfiltration of connected-app data; patched August 18, 2026.
Varonis Threat Labs found that an undocumented autorun=1 parameter, paired with the q parameter, lets an attacker-supplied prompt run automatically on page load in a victim's authenticated Copilot session, then exfiltrate data from connected services such as mail, calendar, Google Drive, chat history and the memory store via Copilot's built-in URL fetch to an attacker webhook. A separate memory-poisoning path through web summarization lets a crafted page persist attacker instructions in the user's memory, surviving password changes, session revocation and device re-enrollment. Microsoft shipped patches on August 18, 2026, tracked as CVE-2026-24301, and Varonis found no evidence of in-the-wild exploitation. The flaws were found via 'meta-hacking', asking Copilot itself to reveal the autorun parameter and its protections.
- autorun=1 plus q parameters execute attacker prompts on page load within the victim's authenticated session
- Exfiltrated data included email bodies, calendar details, Google Drive metadata, chat history and saved instructions
- Injected memories persist across password changes and session revocation until manually deleted
- Patches shipped August 18, 2026; no evidence of exploitation in the wild
- Organizations
- Varonis Threat LabsMSRC
- AI models
- Copilot Personal
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-24299 | Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an unauthorized attacker to disclose information… | 5.3 | <1% | ||
| CVE-2026-24301 | Command Injection in Microsoft Copilot Allows Information Disclosure | 7.5 | 2% |
From the original article
4 min read at thehackernews.com
Varonis Threat Labs has disclosed three vulnerabilities in Microsoft Copilot Personal that it said could allow a single click on a crafted link to silently pull data from connected apps and other information available to the victim's Copilot session. The flaws, which the researchers collectively named CoSnitch , turn in part on an undocumented URL parameter that the assistant itself surfaced during testing.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.