Threat intelligence firm Varonis Threat Labs has uncovered a set of vulnerabilities, collectively dubbed “CoSnitch,” impacting Microsoft Copilot Personal. These flaws, which include CVE-2026-24301, could enable a single-click interaction with a specially crafted link to silently exfiltrate sensitive data from applications connected to a user’s Copilot session. A separate vulnerability also allows for persistent memory poisoning. Microsoft has since released patches for these issues on August 18, 2026, following Varonis’s responsible disclosure in December 2025, according to The Hacker News.
These vulnerabilities specifically affect Copilot Personal, the consumer-facing assistant available at copilot.microsoft.com, and are not stated to impact Microsoft 365 Copilot. Varonis found no evidence of CoSnitch being exploited in the wild prior to the patch.
The CoSnitch Vulnerability Explained
The CoSnitch discovery originated from what Varonis describes as “meta-hacking,” a process of repeatedly querying Copilot about why a prompt couldn’t execute without user interaction. Through this method, the assistant inadvertently revealed an undocumented URL parameter, autorun=1. When combined with the existing q parameter (which typically only pre-fills the input box), the autorun=1 parameter enables a crafted URL to execute a prompt without any explicit user gesture beyond the initial click.
Once the CoSnitch execution is triggered, the prompt runs to completion, even if the victim closes the Copilot tab immediately after the page loads. This one-click exfiltration path can silently pull various types of sensitive data from connected accounts, including:
- Message bodies, subject lines, and sender/recipient metadata from connected mail accounts.
- Calendar titles, attendees, times, and locations.
- File names and metadata summaries from services like Google Drive.
- Full prior conversation content from chat history.
- Saved instructions and user-defined rules held in Copilot’s memory store.
The exfiltration requests generated by CoSnitch are particularly insidious because they are network-layer indistinguishable from legitimate fetches Copilot performs when summarizing ordinary web pages. Attackers could also use Base64 encoding to evade network filters designed to detect sensitive data patterns.
Persistent Memory Poisoning Path
Beyond data exfiltration, Varonis also identified a separate memory-poisoning vulnerability triggered through web summarization. This allows an attacker to inject instructions into Copilot’s memory that persist across password changes, session revocations, and device re-enrollments. These injected instructions remain active in subsequent conversations until the user explicitly deletes them from Copilot’s memory settings.
Crucially, Varonis noted that this memory write process generates no discernible logs, network connections, or file system changes that would typically be flagged by security tooling. The change is only visible within Copilot’s own memory interface.
This isn’t the first instance of Copilot’s memory handling being scrutinized. Prior research by Håkon Måløy and Johann Rehberger, which includes findings associated with CVE-2026-24299 (reported separately by Rehberger for memory modification in the consumer assistant), has also highlighted similar concerns regarding prompt injection and memory persistence in both consumer and Microsoft 365 Copilot environments. Microsoft has acknowledged and addressed these classes of attacks, detailing their mitigations in a June 22 security blog post.
Mitigating Microsoft Copilot Personal Data Exfiltration
Given the stealthy nature and potential impact of these vulnerabilities, mitigating Microsoft Copilot Personal data exfiltration and memory poisoning requires proactive measures from users and organizations.
Varonis recommends the following actions:
- Review Connected Applications: Regularly audit and disconnect any applications or services connected to Copilot that are not actively required or frequently used. Users must authorize services before Copilot can access them, and it operates within existing user permissions.
- Treat Copilot as a Privileged Insider: Consider Copilot’s access capabilities when conducting access reviews and anomaly detection. Its ability to aggregate data across various connected services makes it a high-privilege endpoint for sensitive information.
- Exercise Caution with AI Assistant Links: Be wary of clicking on links that open AI assistants, especially if they are from untrusted sources or seem suspicious. Attackers can leverage crafted URLs to trigger malicious actions.
While Microsoft released patches on August 18, 2026, Varonis’s disclosure did not specify a client-side update for users to install, implying the fix was server-side. It also did not clarify whether Microsoft’s remediation retroactively removed memory entries created before the fix. Therefore, users should manually verify and clear any potentially injected memories within their Copilot settings if they have concerns.
Related: OpenAI ChatGPT Lockdown Mode: Mitigating Prompt Injection Exfiltration, AI Agents Vulnerable to Data Leak via Poisoned MCP Tools