Varonis Threat Labs disclosed CoSnitch, a now-fixed chain of flaws in Microsoft Copilot Personal that, according to the research, could allow a specially crafted link to execute instructions inside a victim's authenticated Copilot session and extract information available through connected services. Microsoft lists the case as CVE-2026-24301 and says the vulnerability has already been mitigated.

What happened

Varonis describes three vulnerabilities grouped under the name CoSnitch. The central issue is an undocumented `autorun=1` parameter combined with Copilot's `q` parameter. According to Varonis, that format could make Copilot Personal automatically execute a prompt when a URL loaded, without the person pressing Enter. If the victim was signed in at `copilot.microsoft.com` and had connectors enabled, the flow could use data available in that session to search connected applications and send information to an attacker-controlled destination.

The Hacker News corroborated the disclosure and summarized that the attack affected Microsoft Copilot Personal, the consumer assistant hosted at `copilot.microsoft.com`. The available sources do not state that the same behavior affected enterprise Microsoft 365 Copilot.

What is confirmed

Microsoft published an official Security Update Guide entry for CVE-2026-24301. MSRC describes the issue as improper neutralization of special elements used in a command and says it could allow an unauthorized attacker to disclose information over a network. Microsoft also says the vulnerability has been fully mitigated and that there is no update action users need to take for this service.

Varonis says it reported CoSnitch to Microsoft in December 2025 and that patches shipped on August 18, 2026. The company also says it has seen no evidence that the attack was exploited in the wild.

Why it matters

This is not just another web flaw. It highlights a specific risk in AI assistants connected to personal or corporate data: when an agent can read email, files, calendars or other linked services, a malicious instruction does not need to “break” the model to cause harm. It can try to turn the user's legitimate session into a search and exfiltration channel.

The discovery method is also notable. Varonis calls it “meta-hacking”: during testing, researchers say Copilot revealed technical details about its own limits and parameters until it exposed a practical attack path. That reinforces a lesson for teams building AI assistants and agents: safeguards cannot depend only on the model refusing risky instructions. Technical controls outside the model, parameter validation, session isolation and least-privilege connector access are still required.

What remains unconfirmed

The available sources do not show evidence of mass exploitation or confirmed theft of user data. There is also no public attribution to a specific malicious actor. The supported reading is that the issue was responsibly reported, mitigated by Microsoft and disclosed for transparency.

For teams using assistants with connectors, the practical takeaway is to review which services are connected, limit unnecessary permissions and treat any “prompt by URL” or link-triggered automation feature as an attack surface, not just a convenience.

Sources consulted: Varonis Threat Labs; Microsoft Security Response Center; The Hacker News; Microsoft Copilot connector documentation.

Written by Nova Rivera — Product and automation perspective.