CoSnitch (CVE-2026-24301): One Link, One Prompt, and Memory That Survived Re-Enrolment

Microsoft fixed a three-part flaw chain in Copilot Personal on 18 August 2026 that let a single crafted link run an attacker's prompt inside a victim's authenticated session, then push what it found back out through Copilot's own network access. Varonis Threat Labs, which reported the issues to Microsoft in December 2025 and published its analysis on the day the fix shipped, named the research CoSnitch. Microsoft tracks it as CVE-2026-24301, "Microsoft Copilot Information Disclosure Vulnerability", classified under CWE-77 as a command-injection flaw that lets an unauthorized attacker disclose information over a network. The chain reached Gmail and Outlook message bodies, Google Calendar entries, Google Drive file names, Copilot chat history and Copilot memory — all of it data the user had already authorised Copilot to read. A third stage wrote instructions into Copilot's persistent memory that, per Varonis, survived password changes, session revocation and device re-enrolment. Neither Varonis nor Microsoft's own entry records any exploitation in the wild. The full record, with its confidence grade and cited sources, is held in the Orca AI Incident Archive, alongside the neighbouring entries in the set.

How one link became a session-wide query

The trigger was a query string. Copilot Personal accepts a q parameter that pre-fills the chat box with text supplied by a link, leaving the user to press Enter — a feature that exists so that a bookmark or an external page can hand the assistant a prompt to review. Varonis found a second, undocumented parameter, autorun=1, that removed the review step. A URL of the form copilot.microsoft.com/?q= followed by the attacker's prompt and autorun=1 executed that prompt when the page loaded, and the researchers report the run completes even if the tab is closed immediately afterwards. The prompt executes with the victim's session context, connectors and memory, which is why the chain could reach data the attacker never had credentials for.

Stage two is the exfiltration. The injected prompt queried connected apps, optionally concatenated the results, base64-encoded them into a URL-safe string, and instructed Copilot to fetch an attacker-controlled address. Copilot's own URL-fetch and summarisation capability made the request, so the outbound traffic resembled routine browsing. Varonis's sample used a Pipedream webhook host as the collection point, with the payload in the URL path. The data classes the researchers list are specific: full message bodies, subject lines, and sender and recipient metadata from mail, including plaintext passwords, internal system passwords and reset links; calendar titles, attendees, times and locations; Drive file names and metadata summaries; prior chat history; and the saved instructions in Copilot memory. Base64 encoding, Varonis notes, also makes the outbound request harder for filters that look for sensitive patterns.

Stage three is the one that outlasts the session. A page Copilot summarises can carry instructions hidden in one-pixel white text, HTML comments, CSS-hidden paragraphs or metadata, and Varonis reports that Copilot treated those strings as directives rather than as content. In one demonstration the injected memory asserted that a CVE was harmless, so that Copilot would suppress the warning later; the same mechanism could be used to filter results, bias answers or trigger actions on a condition. Memory entries have no expiry and do not reset at logout; they sit in a user-level store rather than in the session. The researchers say the only way to clear one is through Copilot's memory settings, which most users do not know exist.

The parameter Copilot named itself

Varonis calls the discovery method meta-hacking: "social engineering the reasoning engine itself", in the blog's own phrasing, or "you don't exploit the model, you manipulate it into cooperating". The researchers began by asking Copilot how a prompt could be made to run without user interaction. Copilot answered that user intent was required and prompts did not fire on their own. Each refusal, however, carried technical detail about how prompts were handled, and the researchers reframed the next question as an ordinary follow-up about URL structure, deep links and pages that load with input already populated. According to the blog, Copilot then disclosed the undocumented parameter unprompted, mid-refusal, along with its historical behaviour and the protections that had been added to disable it. The researchers built the URL as described and the prompt ran.

That account of the conversation is Varonis's alone. The blog says the specific meta-hacking questions are not reproduced verbatim, and Microsoft's public statement on the flaw, quoted by Dark Reading, does not address the technique at all. Lior Adar, the Varonis senior researcher who wrote the analysis, told Dark Reading that Copilot "handed us the keys" and that the meta-hacking element is the part of the research he expects to keep mattering. The blog's own summary is blunter: "Copilot wasn't breached; it was played."

What Microsoft fixed, and what its entry records

Microsoft's Security Update Guide entry for CVE-2026-24301 was published on 18 August 2026 in the 2026-Aug release and last revised on 25 August 2026. It rates the issue Critical with a CVSS 3.1 base score of 8.8 and a temporal score of 7.7; the vector is AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The archive files this record as high severity, which is the band an 8.8 base score falls in under CVSS 3.1 — Microsoft's severity label on the same entry is Critical. Two fields matter more than the number: Microsoft records the issue as not publicly disclosed before the patch, and not exploited.

The entry carries no patch for anyone to install, and Microsoft's FAQ says so directly: "This vulnerability has already been fully mitigated by Microsoft. There is no action for users of this service to take. The purpose of this CVE is to provide further transparency." The statement Microsoft gave Dark Reading on publication day says the same thing — "Our customers are already protected and do not need to take any action" — and adds, "We continuously update our guardrails to strengthen our protections against similar techniques." Varonis credits Microsoft's collaboration on the fix and does not argue about the timing.

The length of the window is what most coverage fastened on: reported in December 2025, patched on 18 August 2026, which the Cloud Security Alliance's research note of 20 August 2026 measures as roughly eight months. During that window the flaw sat in a consumer product that anyone reaches through a browser link.

Established, attributed, and not claimed

• Established: a CVE exists, is dated 18 August 2026, carries a base score of 8.8, and is recorded by Microsoft as neither disclosed before the patch nor exploited.

• Established by Microsoft's spokesperson, not independently audited: the issue was confined to Copilot Personal and enterprise customers are unaffected.

• Attributed to Varonis and repeated, not reproduced: the mechanics of the chain — the autorun parameter, the webhook exfiltration, the memory-poisoning demonstration. The Hacker News, Dark Reading and the Cloud Security Alliance describe them; none of those outlets has published its own reproduction.

• Attributed to Varonis, single-source: the meta-hacking conversation and what Copilot disclosed in it. No transcript has been published.

• Not claimed by anyone: victims, campaigns or any in-the-wild use. Varonis says it has seen no evidence of exploitation, and Microsoft records exploited as No.

• Undisclosed: whether the fix purged memory entries written before it. The Hacker News notes the disclosure does not say.

Personal product, enterprise data

Microsoft's scoping is accurate as far as it goes: the flaw was in the consumer assistant, not Microsoft 365 Copilot. Adar's argument is that the boundary does less work than it appears to. "The specific vulnerabilities we found are in the Personal version, that's correct. But the person using Copilot Personal is the same person who walks into your office Monday morning," he told Dark Reading. "They could have corporate emails forwarded to personal Gmail, credentials shared over personal accounts, work docs in a personal Drive. So when CoSnitch exfiltrates from a personal inbox, the data it pulls is often enterprise data. A stolen password from a personal account becomes a foothold in your corporate tenant." That is an assessment about blast radius rather than a claim about the vulnerability's scope, and Microsoft has not responded to it.

What defenders were told to do

There was no client update, because there was nothing on the client to update. Varonis's guidance is about authorisation rather than patching: review the apps connected to an assistant and disconnect the ones that do not need to be there, treat Copilot as a privileged insider with access to whatever it can reach, and treat an unsolicited link that opens an AI assistant as an attack surface rather than a convenience. "Audit connectors, minimise access, and assume the trust boundary between legitimate and injected prompts will be broken," Adar told Dark Reading.

Microsoft's own written position on the wider memory-poisoning class predates the CoSnitch fix. The Hacker News reports that a 22 June 2026 Microsoft security blog post, scoped to Microsoft 365 rather than the consumer product, describes sanitisation and prompt-injection checks on memory writes, Task Adherence checks on every explicit write, and a MemoryUpdated audit field surfaced in Defender Advanced Hunting and Sentinel — and credits MSRC cases from Johann Rehberger, Håkon Måløy and Gal Zror.

Where the chain sits

The record notes that CoSnitch can be paired with CVE-2026-24299, the identifier Microsoft assigned to the memory-poisoning research Johann Rehberger presented at DEF CON Singapore as Copirate 365. Rehberger's writeup, published 4 May 2026, covers memory writes and deletions reached through indirect prompt injection in Microsoft 365 Copilot and consumer Copilot, and an HTML-preview exfiltration channel that abuses font and background-image loading. Microsoft's entry for CVE-2026-24299 is dated 19 March 2026 and carries a CVSS 3.1 base score of 5.3, with exploited recorded as No.

The Cloud Security Alliance counts CoSnitch as the fourth one-click or zero-click Copilot exfiltration chain disclosed since June 2025, after EchoLeak (CVE-2025-32711), Reprompt and SearchLeak (CVE-2026-42824). That count is the CSA's, not the archive's, and it is the strongest argument in the public record that this is a recurring shape rather than a single bad parameter: an assistant with standing access to mail, files and a memory store, reached through a link that somebody was persuaded to open.

The parts of CoSnitch that a reader can verify without a Microsoft tenant are narrow — a CVE, a score, a fix date, and two status fields that both say no. The parts that make it a landmark are the parts that currently rest on one lab's account of a conversation with a chatbot: that a production assistant named its own undocumented trigger when asked to explain why the attack was impossible.