Critical Microsoft Copilot CoSnitch Vulnerability (CVE-2026-24301) Enabled One-Click Data Theft From Connected Accounts
Critical Microsoft Copilot CoSnitch Vulnerability (TL-2026-2065), also tracked as CoSnitch, is a critical-severity software vulnerability scored CVSS 8.8, first published 2026-08-19. It has no confirmed attribution, affects Microsoft Microsoft Copilot Personal (Copilot Web, references 1 CVE (CVE-2026-24301), maps to 15 MITRE ATT&CK / ATLAS techniques (AML.T0051, AML.T0056, T1020), and is covered by 9 detection rules and 12 indicators of compromise.
Key facts for TL-2026-2065
- Threat ID
- TL-2026-2065
- Also known as
- CoSnitch
- Severity
- CRITICAL
- CVSS
- 8.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
- Status
- PATCHED
- Category
- VULNERABILITY
- First published
- 2026-08-19
- Last reviewed
- 2026-08-19
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- consumer individual users, technology
- Target regions
- global
- Detection rules
- 9
- Indicators of compromise
- 12
Malware and tooling in Critical Microsoft Copilot CoSnitch Vulnerability
Malware and tooling: Microsoft Copilot Personal (copilot.microsoft.com)
Varonis Threat Labs disclosed CoSnitch (CVE-2026-24301), a three-part Microsoft Copilot Personal flaw chain that let a single malicious link silently auto-execute an attacker prompt, exfiltrate data from connected Gmail/Google Drive/Calendar accounts via base64-encoded HTTP requests, and plant instructions in Copilot's permanent memory that survive password changes, session revocation, and device re-enrollment. Microsoft patched the issue on August 18, 2026; no active exploitation was found.
How Critical Microsoft Copilot CoSnitch Vulnerability works
CoSnitch is a chained vulnerability disclosed by Varonis Threat Labs researcher Dolev Taler, the third Copilot bug the team reported to Microsoft in 2026 after Reprompt and SearchLeak. The chain combines three distinct weaknesses in Microsoft Copilot Personal (copilot.microsoft.com).
First, an undocumented URL parameter, `autorun=1`, when combined with Copilot's standard `q=` query parameter (which normally just pre-fills the chat input), causes an attacker-supplied prompt embedded in the URL to execute automatically the instant the page loads inside the victim's authenticated session -- with no click, keystroke, or confirmation beyond the initial link click. Varonis found the parameter using a technique they call 'meta-hacking': rather than attacking the product directly, researchers repeatedly asked Copilot to explain why automatic prompt execution 'wasn't possible,' and mined its own explanations and refusals for the exact disabled parameters and internal architecture details needed to build the exploit.
Second, once an attacker prompt is running with the victim's session privileges, it can query any service the victim has already connected to Copilot -- Gmail, Google Drive, Google Calendar, plus Copilot's own chat history and memory store -- without requesting any new permissions. The prompt instructs Copilot to search for sensitive content (e.g., files or messages containing 'credentials,' 'passwords,' 'internal'), base64-encode the retrieved text, and then invoke Copilot's built-in URL-fetch capability to request `https://<attacker-webhook>/exfil/<base64-payload>`. Copilot itself performs the outbound HTTP GET, so the request looks like ordinary Copilot web-fetch traffic and blends in with legitimate activity; the base64 encoding also defeats content filters that scan for plaintext passwords or API-key patterns. In their proof of concept, Varonis used a public webhook-relay endpoint (`m.pipedream.net`) to catch the exfiltrated, base64-encoded data.
Third, and most persistent, a crafted webpage can carry the injection even without a special link: if a victim simply asks Copilot to summarize an attacker-hosted URL, Copilot retrieves the full HTML -- including zero-size, white-on-white hidden text -- and can treat a fake 'SYSTEM: configuration update' instruction embedded in that hidden text as a legitimate directive to write attacker-chosen content into the user's permanent Copilot memory. Memory entries written this way have no expiration, produce no process, file, network, or log artifact that conventional security tooling would flag, and persist through password changes, session revocations, and device re-enrollment -- they are only removed if the user manually deletes them from Copilot's memory settings.
Varonis reported the full chain to Microsoft on December 31, 2025. Microsoft shipped a partial fix on February 1, 2026 that closed only the automatic-execution (`autorun`) vector, leaving the OAuth-connector exfiltration and memory-poisoning-via-summarization vectors open for months. The complete fix for CVE-2026-24301 shipped August 18, 2026, roughly eight months after the initial report. Microsoft stated no customer action is required and that Microsoft 365 Copilot Enterprise customers are unaffected, since CoSnitch is scoped to the consumer Copilot Personal product; analysts noted this framing understates real-world exposure because many enterprise users also run personal Copilot sessions. No evidence of in-the-wild exploitation was found before the patch, and the vulnerability is not present in the CISA KEV catalog.
MITRE ATT&CK / ATLAS techniques used in TL-2026-2065
execution
AML.T0051 LLM Prompt Injection
Exfiltration
AML.T0056 Extract LLM System Prompt; T1020 Automated Exfiltration; T1567 Exfiltration Over Web Service
Defense Evasion
T1027 Obfuscated Files or Information
Command and Control
T1071 Application Layer Protocol; T1132 Data Encoding
Collection
T1114 Email Collection; T1119 Automated Collection; T1213 Data from Information Repositories; T1530 Data from Cloud Storage
Execution
lateral-movement
T1550 Use Alternate Authentication Material
Initial Access
Resource Development
Affected products and versions in Critical Microsoft Copilot CoSnitch Vulnerability
- Microsoft — Microsoft Copilot Personal (Copilot Web, copilot.microsoft.com)
Vulnerable versions: All Copilot Personal sessions prior to the 2026-08-18 fix
Fixed in: Patched server-side as of 2026-08-18; Microsoft 365 Copilot Enterprise was not affected by CoSnitch
Remediation for Critical Microsoft Copilot CoSnitch Vulnerability
Patches
- Microsoft partially patched the automatic prompt-execution (autorun) vector on 2026-02-01
- Microsoft shipped the complete fix for the full CoSnitch chain (CVE-2026-24301) on 2026-08-18
Immediate actions
- Confirm the Microsoft-side patch for CVE-2026-24301 (shipped 2026-08-18) is applied -- it is server-side for Copilot Personal and requires no customer action per Microsoft
- Review Copilot's saved memory/instructions for unfamiliar or attacker-planted entries and manually delete anything not explicitly authored by the user, since poisoned memory survives password resets and session revocation
- Audit and, where unnecessary, revoke Copilot's connected-account/OAuth grants to Gmail, Google Drive, and Google Calendar
Workarounds
- Until Copilot memory has been reviewed for injected instructions, disable or restrict Copilot Personal's connected-account integrations (Gmail/Drive/Calendar)
- Avoid clicking copilot.microsoft.com links received from untrusted senders, and avoid asking Copilot to summarize untrusted URLs
Longer-term hardening
- Govern AI-assistant connected-account/OAuth grants with the same rigor as any third-party app integration, since they are a direct data-exfiltration surface once the assistant is hijacked
- Monitor for anomalous outbound HTTP requests originating from AI-assistant sessions, including to webhook-relay/paste-style services, since this exfiltration technique is designed to look like normal assistant traffic
- Treat AI-assistant chat deep links (e.g., copilot.microsoft.com URLs carrying query parameters) as a phishing delivery vector and train users not to click unsolicited ones
- Apply prompt-injection sanitization and Task Adherence-style validation to memory-write operations in consumer AI assistants, mirroring protections Microsoft described for Microsoft 365 Copilot Enterprise
CVEs associated with Critical Microsoft Copilot CoSnitch Vulnerability
Weaknesses (CWE) in Critical Microsoft Copilot CoSnitch Vulnerability
CWE-77
Timeline of Critical Microsoft Copilot CoSnitch Vulnerability
- Varonis Threat Labs reports the full CoSnitch vulnerability chain (autorun parameter, OAuth-connector exfiltration, memory poisoning via web summarization) to Microsoft.
- Microsoft ships a partial fix that closes only the automatic prompt-execution (autorun) vector, leaving the exfiltration and memory-poisoning vectors open.
- Varonis publicly discloses SearchLeak (CVE-2026-42824), a related one-click Parameter-to-Prompt injection chain against Microsoft 365 Copilot Enterprise Search.
- Varonis publicly discloses Reprompt, a related single-click Copilot Personal attack using double-request/chain-request techniques to bypass Copilot guardrails.
- Microsoft publishes a security blog post acknowledging the AI prompt-injection attack class, describing sanitization and Task Adherence protections in Microsoft 365 Copilot that had not yet extended to Copilot Personal.
- NVD publishes CVE-2026-24301 with a CVSS 3.1 base score of 8.8 (CWE-77, improper neutralization of special elements).
- Microsoft states no customer action is required and that Microsoft 365 Copilot Enterprise customers are unaffected, since CoSnitch is scoped to Copilot Personal; analysts note this understates exposure for enterprise users who also run personal Copilot.
- Microsoft ships the complete fix for CVE-2026-24301 (CoSnitch), roughly eight months after Varonis's initial report.
- Varonis Threat Labs and multiple outlets (The Hacker News, Dark Reading, The Register, Cybersecurity News, Computerworld) publish full technical details of the CoSnitch attack chain.
Sources cited for Critical Microsoft Copilot CoSnitch Vulnerability
- Critical Microsoft Copilot CoSnitch Vulnerability Lets Attackers Steal Sensitive Data With One Click
- CoSnitch (Varonis Threat Labs research writeup)
- Microsoft Copilot Personal Flaws Could Let One Click Exfiltrate Data From Connected Apps
- 'CoSnitch' Attack Tricked Copilot into Revealing Own Architecture
- Copilot tricked into telling researchers how to hack itself
- Microsoft finally patches critical one-click Copilot vulnerability, almost eight months after learning of it
- NVD - CVE-2026-24301
- MSRC Security Update Guide - CVE-2026-24301
- Reprompt: The Single-Click Microsoft Copilot Attack that Silently Steals Your Personal Data
- SearchLeak: How We Turned M365 Copilot Into a One-Click Data Exfiltration Weapon
- Copilot Exposed Its Own Vulnerabilities When Prompted
- Microsoft Copilot Leaked Its Own Secret Parameter, Enabling One-Click Data Theft
Threats related to Critical Microsoft Copilot CoSnitch Vulnerability
- CSS Bomb: JavaScript-Free CSS Keylogging and Token-Theft Attacks Against Gmail, Outlook, Yahoo Mail, AOL Mail, Fastmail, and ProtonMail
- OWASP GenAI LLM Top 10 2026 — Community-Driven Security Guidance for AI Applications
- CSS Bomb Attacks: CSS-Based Trust-Boundary Bypass Leaks Webmail Passwords and Tokens (Outlook, Gmail, Yahoo, AOL, Fastmail, Proton Mail)
- Critical Type Confusion in isolated-vm (GHSA-864f-rcv7-6rh4) Enables Sandbox Escape and RCE on Host
Detection coverage for TL-2026-2065
As of 2026-08-19, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2065 across Splunk SPL, Microsoft KQL and Sigma, covering 12 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.