REDMOND, 24 AUG 2026 — Microsoft has patched a chain of three weaknesses in Copilot Personal that let a single link turn the assistant against its own user, reading their Gmail, Google Drive and Calendar and posting the contents to an attacker-controlled address. The chain, tracked as CVE-2026-24301 and named CoSnitch by the researchers who found it, was reported to Microsoft in December 2025. The fix shipped on 18 August 2026.
Varonis Threat Labs, which disclosed it, says it has seen no evidence the attack was used in the wild before the patch.
What the chain actually did
The chain combined three weaknesses, each failing in a different part of the system.
One parameter removed the need for the user to consent to anything. A second used Copilot's own authorised connectors to read data the assistant was legitimately allowed to see. The third wrote attacker instructions into Copilot's persistent memory, so the altered behaviour outlived the session that introduced it.
None of the three is a memory-safety bug or an authentication bypass. Every step used a documented capability, working as designed, pointed at a purpose its designers did not intend.
The parameter that removed the click
Copilot accepts a prompt in the URL through a ?q= parameter. That much is ordinary and useful: it is how a share link or a bookmarklet hands the assistant a question.
The unusual part was an undocumented autorun=1 parameter. Paired with a prompt in the URL, it caused that prompt to execute as the page loaded, with no confirmation step and no approval from the user.
The exact interaction matters, because the shorthand in much of the coverage overstates it in one direction and understates it in another. The victim does click once — on the link. What they do not do is approve the prompt, see it, or have any opportunity to stop it. From the user's side a page simply opens. The click buys consent to visit a website, and the chain spends it on consent to read their mail.
Why base64 mattered more than it should
Having executed, the prompt queried the connected accounts, gathered results, and encoded them before sending them out.
The encoding step was not for defeating cryptography but for getting past content filters that inspect what the model is about to emit. Text that would be recognised as an email address or a document body reads, once base64-encoded, as an opaque string.
The exfiltration then used a capability nobody would remove: Copilot can fetch a URL and summarise what it finds. Instructed to fetch an attacker's webhook with the encoded payload in the path, the assistant did exactly what it does hundreds of times a day, and the request left as a normal outbound summarisation.
This is the uncomfortable shape of the whole class of defect. The filter and the fetch are each correct in isolation, and their interaction is the opening. The encoder removes the meaning the filter inspects, and the attacker supplies the page the fetch retrieves.
Memory poisoning is the part that outlasts the session
The third weakness, memory poisoning, should worry an administrator most, because it makes the problem persistent.
Instructions embedded in web content Copilot read could be written into its persistent memory, modifying how the assistant behaved in later, unrelated conversations. A user who clicked a bad link in the morning could carry the consequence into every session afterwards.
A patched parameter closes the door. It does not, by itself, tell a user whether something was written behind it while it was open. Anyone who used Copilot Personal with connectors attached during the exposure window has a memory store worth reviewing rather than assuming clean.
Eight months, and what the interval measures
December to August is a long time for a critical one-click exfiltration path in a consumer product with authenticated access to a user's mail.
On its own, the delay is not evidence of negligence. Fixing this properly meant removing an undocumented parameter, changing how the model's output is inspected when it is encoded, and constraining what may be written to memory from untrusted content. The third of those is a design question rather than a patch, and design questions do not ship in a fortnight.
What the interval does measure is exposure. For eight months the mitigation available to a user was not to click, which is the mitigation that has never worked. It also sits oddly against the industry's own stated norms: a 90-day disclosure window is the common default, and this ran to roughly 240.
The third finding from one team in a year
CoSnitch is the third Copilot weakness this research team has disclosed in 2026, after Reprompt, which got past safety guardrails by asking the same question twice, and SearchLeak, which turned the enterprise edition into a covert exfiltration channel.
Three findings from one team in one product in one year suggest a pattern, and it is not a pattern about Copilot specifically. It is the predictable result of giving a language model untrusted input and authenticated read access to private data in the same context, with no boundary between the two. Every assistant now shipping with connectors has that shape.
The same architecture produced the concern when a ChatGPT plugin asked for full disk access to read Apple Messages, and the account-boundary question when Microsoft put work and personal Copilot in one app. The connector is the attack surface, and it is the feature.
What to do if you use Copilot Personal
Take the patch, which is applied server-side and requires nothing from the user.
Then do the two things the patch does not do. Review what the assistant remembers and clear anything unfamiliar. Then look at which accounts are connected and disconnect the ones that are attached out of convenience rather than use, because a connector that is never queried is pure exposure.
For an administrator, the durable control is not a parameter blocklist. Treating the assistant as an authenticated reader of everything it can reach, and then narrowing what it can reach, is what survives the next defect.
What it means from here
The specific defect is closed and the class is not. Prompt injection through content the model reads has no general fix, and connectors are being added to assistants faster than the boundary problem is being solved.
For teams across the region deploying assistants against corporate mail and document stores, the review question has changed. It is no longer patch speed. It is what the assistant can read, what it can send, and whether the only thing between those two capabilities is a filter that encoding defeats.
View author profile → · Editorial policy
