- The Mess: Researchers turned Microsoft Copilot Personal against its own users. A crafted link could trigger an attacker-controlled prompt and make Copilot access connected services such as Gmail, Google Drive and Calendar. The chain is tracked as CVE-2026-24301, aka CoSnitch.
- The Damage: One click was enough to run the attack inside the victim’s authenticated Copilot session and exfiltrate sensitive data without the usual confirmation flow. The chain could also poison Copilot’s persistent memory.
- The Fix: Microsoft patched Copilot Personal on August 18, 2026. Users should still review connected accounts and treat unexpected Copilot links as hostile. Enterprise Copilot was not affected by this specific issue.
This is one of those AI security bugs that sounds ridiculous until you understand what Copilot can actually access.
Email.
Cloud storage.
Calendars.
Chat history.
Persistent memory.
CoSnitch turned that access into an attack surface.
Copilot Snitched on Itself
The researchers at Varonis Threat Labs didn’t start by reverse-engineering Microsoft’s code.
They asked Copilot questions.
Then more questions.
Then questions about why certain attacks supposedly couldn’t work.
During that process, Copilot revealed enough information about its own URL handling and prompt execution to expose an undocumented attack path.
Varonis called the technique “meta-hacking.” The AI effectively helped researchers map parts of its own security model.
That led to a chain of three weaknesses.
The first allowed automatic prompt execution through a specially crafted Copilot URL.
The second allowed the injected prompt to query information available through connected services.
The third allowed data to be sent to an external attacker-controlled destination.
One Click Changed the Trust Model
Copilot normally expects the user to decide what the assistant should do.
CoSnitch broke that assumption.
A malicious URL could contain an attacker-controlled prompt and trigger its execution when the page loaded.
The victim still had to click the link, but there was no second confirmation asking whether Copilot should access connected data.
That distinction matters.
The attacker wasn’t stealing the victim’s Microsoft password.
They were abusing the authority the victim had already given Copilot.
That’s a much more interesting security problem.
Gmail, Drive and Calendar Were in the Blast Radius
Varonis demonstrated that the injected instructions could make Copilot query connected services, including Gmail, Google Drive and Google Calendar. Copilot’s own conversation history and memory were also exposed to the attack chain.
The data could then be encoded and transferred through Copilot’s own capabilities to an attacker-controlled endpoint.
From the user’s perspective, there might be nothing obviously suspicious.
No malware installation.
No password prompt.
No executable attachment.
Just a legitimate-looking Copilot URL.
That’s the uncomfortable part.
The trusted AI assistant becomes the mechanism for the theft.
The Memory Poisoning Problem
CoSnitch wasn’t limited to stealing existing information.
Researchers also demonstrated persistent memory poisoning.
A malicious webpage could contain instructions that Copilot would absorb while summarizing the content.
Those instructions could then influence future interactions.
Varonis reported that the poisoned memory could survive events such as password changes, session revocation and device re-enrollment.
That’s not a normal prompt injection anymore.
It’s persistence.
The attacker isn’t simply trying to control one conversation.
They’re trying to alter the assistant’s future behavior.
Microsoft Patched It
Microsoft fixed the issue on August 18, 2026, after Varonis reported the vulnerability in December 2025. The issue was assigned CVE-2026-24301 and rated 8.8 High under CVSS 3.1.
There is currently no evidence that CoSnitch was exploited in the wild before the fix.
Microsoft also stated that the affected functionality was limited to Copilot Personal and that enterprise customers were not affected by this specific vulnerability.
That distinction is important.
This isn’t a Microsoft 365 Copilot compromise.
It’s a Copilot Personal problem.
But that doesn’t make it harmless.
Personal accounts often contain work documents, forwarded business emails and credentials. The boundary between “personal” and “corporate” data isn’t always as clean as security diagrams suggest.
The Bigger Problem Is AI Authority
CoSnitch demonstrates a security model that traditional web defenses don’t handle particularly well.
The attacker doesn’t need to execute code on the victim’s machine.
They don’t necessarily need credentials.
They don’t need to compromise the connected service directly.
They manipulate the AI that already has permission to access it.
That’s the new attack surface.
An AI assistant with access to ten services effectively becomes a single privileged interface to ten services.
Compromise the assistant’s instruction boundary and the attacker may not need to compromise those systems individually.
Bugstoday Opinion
CoSnitch is more interesting than another 8.8 CVE.
The researchers didn’t simply find a broken API.
They convinced an AI to explain how its own defenses worked — and then used that information to construct an attack chain.
That’s the warning.
AI assistants are becoming trusted intermediaries between users and their data. Give them broad permissions and a successful prompt injection stops being a chatbot problem.
It becomes an identity problem.
It becomes a data-access problem.
And eventually, it becomes an incident-response problem.
Bugstoday verdict: stop treating AI assistants as chat windows. If Copilot can read your mail, files and calendar, treat it like a privileged application — because that’s exactly what it is.
Today’s Bugs. Tomorrow’s Breaches.
