Affected Systems

Microsoft Copilot Personal (consumer assistant at copilot.microsoft.com). Research does not indicate Microsoft 365 Copilot is affected. Vulnerability tracked as CVE-2026-24301. Patched August 18, 2026.

Exploitation Status

No evidence of exploitation in the wild. Proof-of-concept demonstrated by Varonis Threat Labs. Vulnerabilities disclosed to Microsoft in December 2025 and patched August 18, 2026.

Business Impact

Attackers can craft URLs that automatically execute prompts in victim's authenticated Copilot session without user interaction, exfiltrating email content, calendar data, Google Drive metadata, chat history, and memory store contents from any connected services. Exfiltration requests appear identical to legitimate Copilot web fetches at network layer. Separate memory-poisoning attack via web summarization persists across password changes and session revocations until manually removed. No client-side logs or security tool alerts generated during memory writes.

Urgency

🟠 Within 24 hours

Recommended Actions

  • Verify Microsoft Copilot Personal instances are updated to August 18, 2026 patch level (CVE-2026-24301)
  • Review connected apps in Copilot settings and disconnect services not actively required for business operations
  • Implement URL filtering to block or alert on copilot.microsoft.com URLs containing 'autorun=1' parameter in web proxies and email gateways
  • Treat Copilot as privileged insider in UEBA and anomaly detection platforms; monitor for unusual data access patterns from Copilot sessions
  • Audit Copilot memory stores for injected instructions; check memory settings interface for unexpected entries and remove manually if present
  • Train users to avoid clicking links that open AI assistants directly, especially from untrusted sources

---

# Threat Actor Context

Actor Profile

Varonis Threat Labs is a security research team within Varonis Systems, a data security and analytics company. In this disclosure, Varonis acted as the vulnerability researcher and coordinated disclosure partner, not as a threat actor. The research focused on identifying and responsibly disclosing security flaws in Microsoft Copilot Personal that could be exploited by malicious actors to exfiltrate sensitive data through crafted links. The team employed a novel "meta-hacking" approach, repeatedly querying Copilot itself to surface undocumented parameters and bypass protections.

TTPs (Tactics, Techniques, Procedures)

The CoSnitch vulnerabilities (CVE-2026-24301) enable three distinct attack techniques: (1) Automatic prompt execution via undocumented URL parameters (autorun=1 paired with q) that trigger attacker-supplied prompts on page load within authenticated sessions; (2) Data exfiltration through connected services by querying authorized apps (email, calendar, Google Drive), encoding retrieved data (base64), and using Copilot's built-in URL fetch capability to transmit to attacker-controlled webhooks—network traffic appears identical to legitimate web summarization requests; (3) Persistent memory poisoning through crafted web pages that, when summarized by Copilot, inject attacker instructions into the user's memory store, surviving password changes and session revocation. The attack leverages social engineering (malicious links) for initial access and exploits the trust boundary between user and AI assistant. Related techniques align with T1566.002 (Phishing: Spearphishing Link), T1567.002 (Exfiltration Over Web Service), and T1059 (Command and Scripting Interpreter) adapted for AI prompt injection contexts.

Targets & Patterns

The vulnerabilities affect users of Microsoft Copilot Personal (copilot.microsoft.com), particularly those in technology and software sectors who have connected multiple services (email, calendar, cloud storage) to their Copilot sessions. Targets of value include users with access to sensitive corporate communications, calendar data revealing meeting schedules and attendees, and cloud-stored documents. The attack is opportunistic and scalable—any user who clicks a crafted link while authenticated to Copilot Personal becomes vulnerable. The exfiltration scope is limited to data the victim's account already has permission to access through connected services; the vulnerability does not grant new permissions but abuses existing authorized integrations. Users who have granted Copilot broad service connections present higher-value targets. The memory poisoning path creates persistent compromise that can influence future sessions and data handling.

Historical Context

CoSnitch builds on Varonis's earlier "Reprompt" research, which also used the q URL parameter as an entry point for one-click attacks against Copilot. The CoSnitch disclosure is part of a broader pattern of AI assistant prompt injection vulnerabilities reported in 2025-2026. Researcher Håkon Måløy documented similar memory persistence issues in Microsoft 365 Copilot through web summarization (published June 22, 2026 after 90-day coordination). Johann Rehberger separately reported memory writes and deletions via indirect prompt injection in both Microsoft 365 Copilot and the consumer assistant, associated with CVE-2026-24299. Microsoft addressed the broader class of memory manipulation attacks in a June 22, 2026 security blog post, crediting MSRC cases from Rehberger, Måløy, and Gal Zror. The CoSnitch vulnerabilities were reported to Microsoft in December 2025 and patched on August 18, 2026. No evidence of in-the-wild exploitation was found.

Defensive Recommendations

  • Audit and minimize connected services in Microsoft Copilot Personal settings; disconnect apps not actively required to reduce exfiltration surface area
  • Implement user awareness training on AI assistant link risks; treat URLs containing copilot.microsoft.com with parameters (especially autorun or q) as high-risk phishing vectors
  • Monitor Copilot memory settings for unauthorized entries; review and delete unexpected instructions or rules, particularly after clicking unfamiliar links or summarizing external web content
  • Treat AI assistants as privileged insiders in access review processes; apply anomaly detection to accounts with broad service integrations and monitor for unusual data access patterns
  • For Microsoft 365 environments, leverage Defender Advanced Hunting and Sentinel to query MemoryUpdated fields in audit logs and detect unauthorized memory modifications (note: consumer Copilot Personal may lack equivalent logging)