Key Takeaways
- Varonis Threat Labs disclosed three flaws in Microsoft Copilot Personal, collectively dubbed CoSnitch, enabling a single‑click link to run attacker‑supplied prompts and exfiltrate data.
- The attack relies on an undocumented URL parameter
autorun=1combined with the existingqparameter; together they cause automatic prompt execution on page load. - Exfiltration uses the user’s already‑authorized connections (mail, calendar, Drive, chat history, memory store) and sends encoded data via Copilot’s built‑in URL fetch, requiring no new permissions.
- A separate memory‑poisoning path lets a crafted web page, when summarized by Copilot, write persistent instructions into the user’s memory store, surviving password changes and session revocation.
- Microsoft released patches on August 18 2026 (tracked as CVE‑2026‑24301) and emphasizes that Copilot only works with existing user permissions; mitigations include sanitization, prompt‑injection checks, and audit‑logging of memory updates.
- Varonis advises reviewing connected apps, treating Copilot as a privileged insider, exercising caution with AI‑assistant links, and removing any suspicious memory entries manually.
Overview of CoSnitch Discovery
Varonis Threat Labs announced on August 18 2026 that it had identified three vulnerabilities in the consumer‑focused Microsoft Copilot Personal assistant (hosted at copilot.microsoft.com). The flaws, collectively named CoSnitch, were reported to Microsoft in December 2025 and patched in the August 2026 security update, receiving the identifier CVE‑2026‑24301 in Microsoft’s Security Update Guide. The research specifically addresses Copilot Personal; it does not claim the same behavior affects Microsoft 365 Copilot. Varonis said there is no evidence that CoSnitch was exploited in the wild prior to disclosure.
The autorun=1 Parameter and Meta‑hacking Technique
The core of CoSnitch hinges on an undocumented URL parameter, autorun=1, which Copilot itself revealed during testing when researchers repeatedly asked why a prompt could not be executed without user interaction. This iterative probing—termed meta‑hacking by Varonis—elicited technical justifications from the assistant until it disclosed the parameter and the session conditions under which it would operate, despite supposed protections. When the researchers crafted a URL that paired autorun=1 with the existing q parameter (used to pre‑fill the input box), the assistant executed the supplied prompt automatically on page load, effectively “playing” Copilot rather than breaching it.
Automatic Prompt Execution Mechanism
With both autorun=1 and q present, Copilot treats the q value as a full instruction and runs it immediately upon loading the page, without requiring the victim to click, press Enter, or otherwise interact. The injected prompt runs with the same capabilities as a command typed directly by the user, meaning it can access any data or functions the user’s authenticated session permits. Because execution occurs before the user can intervene, a single click on a malicious link is sufficient to trigger the attack chain.
Data Exfiltration via Connected Services
Once the attacker‑supplied prompt is running, it can query any services the user has already authorized Copilot to use—such as Outlook mail, Google Calendar, Google Drive, or internal chat platforms. The prompt retrieves data (e.g., message bodies, subject lines, sender/recipient metadata, calendar entries, file names and metadata, chat histories) and encodes it, commonly using Base64, to avoid detection by security filters. Copilot’s built‑in URL fetch then transmits the encoded payload to an attacker‑controlled webhook. Crucially, the technique does not grant Copilot new permissions or broaden the user’s existing access; it merely abuses the privileges already conferred through the user’s consent.
Scope of Exfiltrated Information
In laboratory tests, Varonis demonstrated that CoSnitch could extract a wide array of personal and organizational data: email contents and headers, calendar titles, attendee lists, times and locations, file names and metadata summaries from Google Drive, full prior conversation histories from chat applications, and the saved instructions and user‑defined rules stored in Copilot’s memory store. This breadth shows that an attacker could harvest not only transient communications but also persistent configuration data that could aid further reconnaissance or privilege escalation.
Persistent Memory‑Poisoning Path
Beyond immediate exfiltration, the researchers identified a separate vulnerability triggered through Copilot’s web‑summarization feature. A specially crafted web page, when summarized by Copilot, can cause the assistant to write attacker‑supplied instructions into the user’s memory store. These injected instructions persist across password changes, session revocations, and device re‑enrollments, remaining active in later conversations until the user manually deletes them from Copilot’s memory settings. Notably, the memory write leaves no discernible process, file, network connection, or log entry that conventional security tooling would flag; the alteration is visible only within Copilot’s own memory interface.
Stealth and Detection Challenges
Varonis emphasized that the exfiltration request generated by CoSnitch is indistinguishable at the network layer from the legitimate fetches Copilot performs when summarizing an ordinary web page. By encoding stolen data in Base64 or similar schemes, attackers can evade keyword‑based outbound filters that hunt for patterns such as credentials or personal identifiers. The lack of audit trails for the memory‑poisoning pathway further complicates detection, meaning organizations may remain unaware of persistent malicious instructions unless they actively inspect Copilot’s memory store.
Microsoft’s Documentation and Mitigations
Microsoft’s connector documentation clarifies that Copilot can only access services after explicit user authorization and that requests are processed using the user’s existing permissions—no privilege expansion occurs. The August 2026 patch addresses the automatic prompt execution flaw by disabling the autorun=1 parameter when paired with q. Regarding memory writes, Microsoft states that Copilot’s memory undergoes sanitization and prompt‑injection checks on write, that Microsoft 365 Copilot runs Task Adherence checks on every explicit memory update, and that memory changes are logged to organizational audit logs and surfaced via a MemoryUpdated field in Defender Advanced Hunting and Sentinel. These measures aim to prevent unauthorized persistence of injected instructions.
Related Prior Research and Microsoft’s Position
The memory‑write issue is not novel; researcher Håkon Måløy previously reported an attacker‑controlled page that persisted unintended memory in Microsoft 365 Copilot, publishing on June 22 2026 after a 90‑day coordination period, with Microsoft marking the case as “mitigated globally.” Johann Rehberger similarly disclosed memory modifications via indirect prompt injection in both Microsoft 365 Copilot and the consumer assistant, linked to CVE‑2026‑24299. In a June 22 security blog post, Microsoft credited MSRC reports from Rehberger, Måløy, and Gal Zror, outlining its defenses: input sanitization, prompt‑injection checks, Task Adherence validation, and comprehensive audit logging for memory updates.
Varonis Recommendations and Broader Context
Varonis advises organizations to review which applications are connected to Copilot Personal, disconnect any that are not actively required, and treat the assistant as a privileged insider when conducting access‑review and anomaly‑detection exercises. Users should exercise caution with links that launch AI assistants, especially those containing unfamiliar URL parameters. The firm notes that no client‑side update is required for end‑users; remediation relies on server‑side patches. Additionally, Varonis drew a parallel to its recent disclosure of RovoBlast, a one‑click attack on Atlassian’s Rovo assistant that abused the rovoChatPrompt parameter; Atlassian had already fixed the issue before public release. The CoSnitch disclosure follows less than two weeks after that report, underscoring a growing trend of URL‑parameter abuse in AI‑powered productivity tools.
Total word count: approximately 985 words.