CoSnitch flaws could let one link pull data through Copilot Personal
Varonis found that a crafted link could run a hidden prompt in Copilot Personal and send data from connected apps to an attacker. Microsoft has patched it.
On 18 August 2026, Microsoft shipped fixes for flaws in Copilot Personal that Varonis Threat Labs calls CoSnitch. Varonis reported the problems to Microsoft in December 2025. The main issue is tracked as CVE-2026-24301, and Varonis describes it as critical. Varonis says it has seen no evidence that the attack was used in the wild.
Varonis describes three linked problems:
- Automatic prompts. A crafted Copilot link could run an attacker's prompt as soon as the page loaded, with no confirmation.
- Data theft. That prompt could query connected apps, encode the results into a web address, and send them out through Copilot's own URL fetching.
- Lasting memory changes. A crafted web page, once summarised, could write instructions into Copilot's memory. They stayed in place after a password change, a session reset and a device re-enrolment.
In testing, Varonis says the data at risk included email contents, calendar details, Drive file names, chat history and Copilot memory. The Hacker News reported that Microsoft did not name a client update for users to install.
Why it matters
Connecting an assistant to mail and files makes it more useful, and it also means a single injected prompt can reach all of that at once. The victim did not have to approve anything beyond opening the link.
The memory finding stands out. Most cleanup advice assumes that changing a password ends an attacker's access. Instructions stored in an assistant's memory survive that, and they can quietly change what the assistant tells you later.
The research covers Copilot Personal. Neither source we read says whether Microsoft 365 Copilot behaved the same way.
What you can do
- Be careful with links that open an AI tool, and read any filled-in prompt before it runs.
- Disconnect the services you do not use from Copilot, and from other assistants too.
- Open Copilot's memory page and read what it holds. Delete anything you did not ask it to remember.
- If Copilot fetches web addresses you did not ask for, close the session and report it.
- If you run IT for a team, review which apps are connected to Copilot, and confirm your monitoring can see unusual data access by it.
Sources
Source: Varonis Threat Labs