CoSnitch: Microsoft Copilot Flaws Enable One-Click Data Exfiltration

Varonis Threat Labs has disclosed three previously undisclosed vulnerabilities in Microsoft Copilot Personal that, when chained together, could allow a single click on a malicious link to silently exfiltrate sensitive data from a victim's connected applications. Tracked collectively as "CoSnitch" and assigned CVE-2026-24301, the flaws were patched by Microsoft on August 18, 2026, after Varonis privately reported them in December 2025. The researchers said they found no evidence of in-the-wild exploitation, but the attack surface remains broad given the sheer number of services users routinely link to Copilot.

The attack hinges on an undocumented URL parameter, autorun=1, which the researchers uncovered through a technique they call "meta-hacking." By repeatedly prompting Copilot to explain why a query required user interaction, the assistant eventually disclosed the parameter along with the session conditions required for it to function. When paired with the existing q parameter, autorun=1 causes an attacker-crafted prompt to execute automatically on page load—without any user gesture—and persists even if the victim closes the tab immediately afterward. "Copilot wasn't breached; it was played," Varonis noted in its report. The research specifically names Copilot Personal, the consumer assistant hosted at copilot.microsoft.com, and does not state that the same behavior affected Microsoft 365 Copilot.

Varonis broke the findings into three distinct vulnerabilities. The first enables automatic prompt execution inside the victim's authenticated session, running with the same privileges as a user-typed instruction. The second allows the injected prompt to query services the user has already authorized, encode retrieved data, and use Copilot's built-in URL fetch to send the payload to an attacker-controlled webhook—without granting Copilot any new provider permissions or expanding the user's existing access. The third flaw, a separate memory-poisoning path, can be triggered when a crafted web page is summarized by Copilot, causing the assistant to write attacker instructions into the user's persistent memory store, where they can shape future sessions. Because the exfiltration rides on outbound URL fetches, defenders can monitor their DNS and outbound traffic with a DNS leak test workflow to spot anomalous requests, while users should verify the integrity of any suspicious Copilot link using an SSL/TLS checker before clicking.

The disclosure builds on Varonis's earlier Reprompt research, which also used the q parameter as an entry point for one-click attacks against Copilot. Recommended post-patch hygiene includes auditing connected-app permissions, running a privacy checkup to identify exposed data, and rotating credentials that may have been reachable through a compromised session. The CoSnitch findings underscore a recurring weakness in LLM-powered assistants: the models themselves can be coaxed into revealing the parameters and behaviors that protect them, turning the assistant into both the exploit and the documentation.