CoSnitch: Copilot Could Execute Prompts from a Link and Steal Personal Data

A vulnerability chain inside Copilot Personal

Varonis Threat Labs identified a vulnerability chain in Microsoft Copilot Personal that could turn a simple link click into the automatic execution of commands. The attack, dubbed CoSnitch, combined technical information disclosure, prompt injection, persistent memory poisoning, and data exfiltration.

Microsoft released fixes on August 18, 2026, after being notified of the issue in December 2025. Varonis said it had found no evidence of real-world exploitation.

The vulnerability is tracked as CVE-2026-24301 and received a CVSS 3.1 score of 8.8, with the following vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

The score reflects a remotely exploitable flaw requiring no prior privileges, although the victim must interact with it by clicking a link. Potential impacts affect the confidentiality, integrity, and availability of accessible information.

The hidden parameter that triggered the prompt

The investigation began with an apparently theoretical question: under what conditions could Copilot execute a prompt without direct user interaction?

The chatbot’s responses denied that a command could be launched without the user’s intent, but at the same time revealed details about the system’s internal operation. By asking successive questions about URLs, deep links, query parameters, and page-load behavior, the researchers reconstructed parts of Copilot’s architecture.

Varonis called this technique meta-hacking. The assistant is queried to obtain information about its own behavior, prompt-handling mechanisms, and link structure. The details collected can then be used to build a more targeted attack.

Before the fix, the undocumented ?autorun=1 parameter, combined with a parameter containing the prompt, could automatically execute the command when the page was opened. The link structure looked similar to this:

copilot.microsoft.com/?q=<malicious_prompt>&autorun=1

The domain remained Copilot’s legitimate domain. The victim still had to click the link, but no additional confirmation was required to launch the embedded prompt.

The command ran within the victim’s authenticated session, using the privileges and connections already available to Copilot. The issue therefore involved more than opening a manipulated page: the link could serve as a vehicle for delivering instructions to an assistant already connected to multiple services.

What data could be accessed

According to the analysis, a malicious prompt could instruct Copilot to perform actions on services accessible through the user’s session. Potentially affected resources included:

• Gmail;
• Google Drive;
• Google Calendar;
• Copilot’s persistent memory;
• conversation history.

An attacker could use the system to search for information, collect messages and documents, review appointments, or conduct reconnaissance. The data identified could then be transferred externally through the functionality and connections available to the assistant.

The risk was not limited to reading data. A prompt could also insert content into Copilot’s memory, making it available in subsequent interactions. This manipulated information could alter future responses, influence the system’s decisions, or affect how it interpreted legitimate requests.

Memory poisoning therefore adds a persistent component to the attack. The compromise does not necessarily end with a single session: false content or malicious instructions may remain in the context used by the assistant.

The boundary between personal accounts and corporate data

According to Microsoft, Microsoft Copilot Enterprise was not affected. The vulnerability impacted Microsoft Copilot Personal.

This limitation does not eliminate the risk to organizations. Personal accounts may contain work-related data or have indirect connections to corporate resources. Examples include corporate emails forwarded to private Gmail accounts, work documents stored on personal Drives, and credentials kept in accounts unmanaged by the organization.

Even a password stolen from a personal account can provide a starting point for accessing other environments. The impact depends on the configured connections and available privileges, which may not be visible to the organization.

CoSnitch therefore highlights a broader problem affecting AI assistants with access to numerous information sources: the system may have extensive privileges without being able to determine which instructions are trustworthy and which are hostile content. A sentence inserted into a prompt, webpage, or connected source may be improperly treated as a command.

What users and administrators should do

Microsoft said customers are already protected and that no specific action is required. The fix addresses CVE-2026-24301, but users should still verify that Copilot Personal is running the latest version of the service.

From an operational perspective, organizations should:

• review the connectors associated with AI assistants;
• limit permissions to only the resources required;
• separate personal accounts from corporate data;
• avoid forwarding corporate emails to private inboxes;
• avoid storing work documents or credentials on personal Drives;
• review assistants’ persistent memory and remove unexpected content;
• monitor for unusual access to Gmail, Drive, Calendar, and connected Microsoft accounts;
• be cautious of links that open Copilot directly with unusual parameters.

If suspicious activity is detected, review conversation history, permissions granted to connected services, and recent account access. Unexpected data in Copilot’s memory may indicate tampering that warrants investigation, although it is not, by itself, proof of a compromise.

Varonis found no evidence of in-the-wild exploitation. Nevertheless, the combination of automatic execution, contextual data access, persistent memory, and architectural disclosure makes the case significant: an assistant can simultaneously become a reconnaissance tool, an operational engine, and an exfiltration surface.