Critical Microsoft Copilot CoSnitch Vulnerability (CVE-2026-24301) Enabled One-Click Data Theft From Connected Accounts — Threadlinqs Intelligence
As of 2026-08-19, Critical Microsoft Copilot CoSnitch Vulnerability (CVE-2026-24301) Enabled One-Click Data Theft From Connected Accounts is a critical-severity vulnerability threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 12 indicators of compromise.
Threat ID: TL-2026-2065 · Severity: CRITICAL · CVSS: 8.8 · Status: PATCHED · Category: VULNERABILITY
Varonis Threat Labs disclosed CoSnitch (CVE-2026-24301), a three-part Microsoft Copilot Personal flaw chain that let a single malicious link silently auto-execute an attacker prompt, exfiltrate data
CoSnitch is a chained vulnerability disclosed by Varonis Threat Labs researcher Dolev Taler, the third Copilot bug the team reported to Microsoft in 2026 after Reprompt and SearchLeak. The chain combines three distinct weaknesses in Microsoft Copilot Personal (copilot.microsoft.com).
First, an undocumented URL parameter, `autorun=1`, when combined with Copilot's standard `q=` query parameter (which normally just pre-fills the chat input), causes an attacker-supplied prompt embedded in the URL to execute automatically the instant the page loads inside the victim's authenticated session -- with no click, keystroke, or confirmation beyond the initial link click. Varonis found the parameter using a technique they call 'meta-hacking': rather than attacking the product directly, researchers repeatedly asked Copilot to explain why automatic prompt execution 'wasn't possible,' and mined its own explanations and refusals for the exact disabled parameters and internal architecture details needed to build the exploit.
Second, once an attacker prompt is running with the victim's session privileges, it can query any service the victim has already connected to Copilot -- Gmail, Google Drive, Google Calendar, plus Copilot's own chat history and memory store -- without requesting any new permissions. The prompt instructs Copilot to search for sensitive content (e.g., files or messages containing 'credentials,' 'passwords,' 'internal'), base64-encode the retrieved text, and then invoke Copilot's built-in URL-fetch capability to request `https://<attacker-webhook>/exfil/<base64-payload>`. Copilot itself performs the outbound HTTP GET, so the request looks like ordinary Copilot web-fetch traffic and blends in with legitimate activity; the base64 encoding also defeats content filters that scan for plaintext passwords or API-key patterns. In their proof of concept, Varonis used a public webhook-relay endpoint (`m.pipedream.net`) to catch the exfiltrated, base64-encoded data.
Third, and most persistent, a crafted webpage can carry the injection even without a special link: if a victim simply asks Copilot to summarize an attacker-hosted URL, Copilot retrieves the full HTML -- including zero-size, white-on-white hidden text -- and can treat a fake 'SYSTEM: configuration update' instruction embedded in that hidden text as a legitimate directive to write attacker-chosen content into the user's permanent Copilot memory. Memory entries written this way have no expiration, produce no process, file, network, or log artifact that conventional security tooling would flag, and persist through password changes, session revocations, and device re-enrollment -- they are only removed if the user manually deletes them from Copilot's memory settings.
Varonis reported the full chain to Microsoft on December 31, 2025. Microsoft shipped a partial fix on February 1, 2026 that closed only the automatic-execution (`autorun`) vector, leaving the OAuth-connector exfiltration and memory-poisoning-via-summarization vectors open for months. The complete fix for CVE-2026-24301 shipped August 18, 2026, roughly eight months after the initial report. Microsoft stated no customer action is required and that Microsoft 365 Copilot Enterprise customers are unaffected, since CoSnitch is scoped to the consumer Copilot Personal product; analysts noted this framing understates real-world exposure because many enterprise users also run personal Copilot sessions. No evidence of in-the-wild exploitation was found before the patch, and the vulnerability is not present in the CISA KEV catalog.
Target sectors: consumer individual users, technology
Target regions: global
Timeline
- Varonis Threat Labs reports the full CoSnitch vulnerability chain (autorun parameter, OAuth-connector exfiltration, memory poisoning via web summarization) to Microsoft.
- Microsoft ships a partial fix that closes only the automatic prompt-execution (autorun) vector, leaving the exfiltration and memory-poisoning vectors open.
- Varonis publicly discloses SearchLeak (CVE-2026-42824), a related one-click Parameter-to-Prompt injection chain against Microsoft 365 Copilot Enterprise Search.
- Varonis publicly discloses Reprompt, a related single-click Copilot Personal attack using double-request/chain-request techniques to bypass Copilot guardrails.
- Microsoft publishes a security blog post acknowledging the AI prompt-injection attack class, describing sanitization and Task Adherence protections in Microsoft 365 Copilot that had not yet extended to Copilot Personal.
- Microsoft ships the complete fix for CVE-2026-24301 (CoSnitch), roughly eight months after Varonis's initial report.
- Microsoft states no customer action is required and that Microsoft 365 Copilot Enterprise customers are unaffected, since CoSnitch is scoped to Copilot Personal; analysts note this understates exposure for enterprise users who also run personal Copilot.
- NVD publishes CVE-2026-24301 with a CVSS 3.1 base score of 8.8 (CWE-77, improper neutralization of special elements).
- Varonis Threat Labs and multiple outlets (The Hacker News, Dark Reading, The Register, Cybersecurity News, Computerworld) publish full technical details of the CoSnitch attack chain.
Related threats
- CSS Bomb: JavaScript-Free CSS Keylogging and Token-Theft Attacks Against Gmail, Outlook, Yahoo Mail, AOL Mail, Fastmail, and ProtonMail
- OWASP GenAI LLM Top 10 2026 — Community-Driven Security Guidance for AI Applications
- CSS Bomb Attacks: CSS-Based Trust-Boundary Bypass Leaks Webmail Passwords and Tokens (Outlook, Gmail, Yahoo, AOL, Fastmail, Proton Mail)
- Critical Type Confusion in isolated-vm (GHSA-864f-rcv7-6rh4) Enables Sandbox Escape and RCE on Host
Detections & IOCs
As of 2026-09-06, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 12 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
VULNERABILITY, CRITICAL, threat intelligence, cybersecurity, CVE-2026-24301, T1583, T1566, T1204, T1550, T1027, T1114, T1530, T1213, T1119, T1132
