Microsoft fixes CoSnitch flaw that let Copilot leak data

Researchers at Varonis Threat Labs have found a critical flaw in Microsoft Copilot, the consumer version of Microsoft's AI assistant hosted at copilot.microsoft.com. Named CoSnitch, it allowed user data — including passwords — to leak the moment a victim clicked a single link, with no confirmation or extra action required. Varonis reported the flaw to Microsoft in December 2025; a partial fix followed in February 2026, and a complete patch shipped on August 18, 2026. The flaw is tracked as CVE-2026-24301, with a CVSS severity score of 8.8 out of 10, rated critical.

Prompt injection is a technique in which an attacker hides instructions inside content a language model processes — here, a URL parameter or a web page — so the model executes them instead of, or alongside, the instructions its legitimate user intended. Two variants of this mechanism sit at the heart of CoSnitch.

An AI assistant questioned about its own flaws

The discovery came from an unusual method. Varonis researchers wanted to build an exploit that could exfiltrate data with nothing more than a click from the victim. Copilot kept refusing: its guardrails require an explicit user gesture, such as a keystroke, before any sensitive action runs. Rather than reverse-engineer the assistant, the researchers questioned Copilot itself about the nature of that protection — why auto-execution was blocked, what URL structures and deep links were involved, what happened when a page loaded with text already sitting in the input field. Each refusal leaked a new technical detail about Copilot's internal architecture, until the assistant eventually disclosed a genuine Microsoft trade secret: an undocumented URL parameter that completely bypassed the consent requirement.

An attack chain triggered by a single click

That parameter was ?autorun=1. Combined with the already-known ?q= parameter, used to preload Copilot's chat field from a link, it triggered the injected prompt the instant the page loaded — no click, no keystroke, no confirmation. A link built on this pattern, sent by email, chat message, or hidden behind a QR code, was enough: once the victim opened it in a browser where they were already signed in to Copilot, the prompt executed inside their authenticated session, with access to their connected apps, memory, and data — even if the tab was closed immediately after loading.

• A hidden URL parameter (?autorun=1) triggered a prompt automatically as soon as the page loaded, with no user confirmation.
• The injected prompt could search the victim's inbox and connected apps — Gmail, Google Drive, OneDrive — and extract sensitive data, including passwords sent by email.
• Stolen data was base64-encoded and sent to an attacker-controlled server through Copilot's own URL-fetch function.
• A separate variant poisoned the assistant's permanent memory through a booby-trapped web page: once Copilot summarized it, hidden instructions were injected that persisted even after a password change, a session revocation, or a full device re-enrollment.

The August 18 patch, in a string of Copilot flaws

Microsoft first neutralized the ?q= parameter in February 2026, blocking it from injecting text directly into the chat field and forcing users to click and type manually — breaking some third-party browser integrations that relied on the parameter as originally designed. A more comprehensive fix followed on August 18, 2026, roughly eight months after Varonis's initial report. According to the security firm, no active exploitation of CoSnitch was recorded before the fix. Microsoft thanked the researchers and said in a statement that customers were protected without needing to take any action, adding that it 'continuously updates guardrails to strengthen protections against similar techniques.' CoSnitch is the latest in a string of vulnerabilities affecting Copilot: EchoLeak, in June 2025, already demonstrated a zero-click attack against the assistant; Reprompt, in January 2026, exploited a comparable parameter-turned-prompt mechanism to exfiltrate conversation history; SearchLeak, in June 2026, tracked as CVE-2026-42824, targeted the enterprise version by combining parameter injection with a security-policy bypass. Microsoft says CoSnitch affects only Copilot Personal, the consumer version, and that Microsoft 365 Copilot, the enterprise product, is not affected — though Varonis notes that a personal account linked to work data could widen the real exposure.

For any company deploying Copilot internally, the CoSnitch episode — even though Microsoft says it is limited to the consumer version — is a concrete reminder: an AI assistant connected to email, files, and internal tools inherits every privilege of the account it serves, so a flaw in its guardrails becomes, immediately, a flaw in access to company data. IT teams should apply AI assistant security patches as systematically as operating-system updates, limit the number of apps and connectors granted to these assistants, and train staff to be wary of links received by email or chat, including ones that appear to point to a familiar Microsoft tool. The fact that the poisoned memory persisted past a password change is also a reminder that an incident involving an AI assistant does not always close with the usual remediation steps.