Microsoft Copilot Flaws Could Let Attackers Steal Data With a Single Click
Security researchers at Varonis Threat Labs have disclosed three vulnerabilities in Microsoft Copilot Personal that could allow attackers to silently access and exfiltrate information from services connected to a victim's Copilot account.
The vulnerabilities, collectively named CoSnitch, could allow a specially crafted link to automatically execute an attacker controlled prompt inside a victim's authenticated Copilot session.
Microsoft was notified about the vulnerabilities in December 2025 and released fixes on August 18, 2026.
The main vulnerability is tracked as CVE-2026-24301. The research focuses on Copilot Personal, the consumer version available through copilot.microsoft.com. Varonis did not claim that the same behavior affected Microsoft 365 Copilot.
Attack Can Start With One Click
The researchers discovered an undocumented URL parameter called autorun=1 while investigating whether Copilot prompts could be executed without a user's interaction.
Varonis described the technique as "meta-hacking." Researchers repeatedly asked Copilot why a prompt could not automatically execute. During testing, the assistant eventually revealed the parameter and described conditions under which it could work.
Researchers then created a URL combining autorun=1 with Copilot's existing q parameter.
When the URL was opened, the attacker supplied prompt could automatically execute inside the victim's authenticated Copilot session.
Varonis said the attack did not require the victim to manually type or submit the malicious prompt.
Connected Services Could Be Targeted
The researchers found that the automatically executed prompt could interact with services already connected to the victim's Copilot account.
During testing, Copilot was able to access information including:
- Email message bodies
- Email subject lines
- Sender and recipient information
- Calendar titles and event details
- Meeting attendees, times and locations
- Google Drive file names and metadata
- Previous Copilot conversation content
- Saved Copilot instructions and memory information
The attack does not provide additional permissions to the attacker. Instead, Copilot accesses information using the permissions that the victim has already granted to connected services.
Microsoft's documentation states that connected services operate using the user's existing permissions and that Copilot does not expand those permissions.
Data Could Be Sent to an Attacker
According to Varonis, the malicious prompt could instruct Copilot to retrieve information and then use Copilot's built in URL fetching capability to send the collected data to an attacker controlled server.
The researchers said this outbound request can resemble normal web requests made when Copilot retrieves content from websites.
They also demonstrated the use of Base64 encoding to make sensitive information less obvious to security filters that inspect outbound requests.
The technique could therefore allow sensitive information to leave the victim's environment without requiring the attacker to directly connect to the victim's connected services.
Copilot Memory Could Also Be Manipulated
The third vulnerability involves Copilot's memory functionality.
Varonis found that a specially crafted webpage summarized by Copilot could cause attacker controlled instructions to be written into the user's Copilot memory.
Once stored, those instructions could influence future Copilot conversations.
The researchers said the injected memory could survive:
- Password changes
- Session revocation
- Device re-enrollment
According to Varonis, the malicious memory remains active until the user manually removes it from Copilot's memory settings.
The memory modification does not create a conventional process, file, network connection or security log that would necessarily alert endpoint security tools.
No Evidence of Real World Exploitation
Varonis said it found no evidence that CoSnitch has been exploited in the wild.
The company reported the vulnerabilities to Microsoft in December 2025, and Microsoft released remediation on August 18, 2026.
Users do not appear to need to install a separate client update based on the information released by Varonis.
However, the researchers recommended reviewing connected applications and disconnecting services that are not actively required.
Previous Copilot Memory Research
The disclosure follows several other reports involving prompt injection and Copilot memory.
Researcher Håkon Måløy previously documented a technique that could cause attacker controlled content to persist in Microsoft 365 Copilot memory through a web summarization workflow.
Security researcher Johann Rehberger has also reported techniques involving indirect prompt injection and manipulation of Copilot memory.
Microsoft has separately described security protections for Microsoft 365 Copilot memory, including sanitization and prompt injection checks. Microsoft has also said that organizational memory updates can be recorded through audit systems.
Microsoft Copilot Security Concerns
CoSnitch highlights the security risks created when AI assistants are connected to multiple external services.
A malicious webpage or link does not necessarily need direct access to a victim's email, files or calendar. If an AI assistant has permission to access those resources, attackers may attempt to manipulate the assistant into retrieving and processing the information on their behalf.
Varonis recommends treating AI assistants such as Copilot as privileged systems and regularly reviewing their connected services and permissions.
Users should also be cautious when opening links that automatically launch AI assistants or contain unusual parameters.
