Do Copilot users need to do anything now that CoSnitch is patched?

Microsoft shipped the CoSnitch patches on August 18, 2026, so the one-click auto-run path is closed without user action. Instructions already written into Copilot's memory store are a separate problem: Varonis reports they survive password changes and device re-enrollment, so anyone worried should review and delete saved Copilot memories by hand.

What data could CoSnitch reach?

CoSnitch reached whatever the victim's Copilot session was connected to. Varonis lists message bodies, subject lines and sender and recipient metadata from linked mail accounts, calendar titles, attendees, times and locations, file names and metadata summaries from Google Drive, full prior chat history, and the user's saved memory instructions.

Was CoSnitch used by real attackers?

Varonis Threat Labs found no evidence that CoSnitch was exploited in the wild before Microsoft's fix. The researchers reported the chain privately in December 2025 and held publication until the patch shipped roughly eight months later, on August 18, 2026.

Does CoSnitch affect Microsoft 365 Copilot at work?

The Varonis research targets Microsoft Copilot Personal, the consumer assistant at copilot.microsoft.com. The published reports do not state whether Microsoft 365 Copilot, the work version, is affected, so enterprise admins should treat that as unanswered rather than assume either way.

Varonis · 2026-08-18 · major

CoSnitch — Copilot explained its own flaws, then leaked user data

Varonis Threat Labs chained three Microsoft Copilot Personal flaws, tracked as CVE-2026-24301, so one clicked link could quietly pull a victim's mail, files and chat history. Microsoft shipped patches on August 18, 2026.

Varonis Threat Labs CoSnitch research on Microsoft Copilot

Varonis chained three Microsoft Copilot Personal flaws so one clicked link could silently steal mail, files and chat history.

Quick facts

Reported by	Varonis Threat Labs
Affected product	Microsoft Copilot Personal (copilot.microsoft.com)
CVE	CVE-2026-24301
Chained flaws	3
Reported to Microsoft	December 2025
Patched	August 18, 2026
Exploited in the wild	No evidence found

What is it?

CoSnitch is a chain of three flaws in Microsoft Copilot Personal, disclosed by Varonis Threat Labs on August 18, 2026 and tracked as CVE-2026-24301. A single click on a crafted link was enough to run an attacker's prompt inside the victim's own signed-in session, with no further interaction. Microsoft patched it the same day the research was published.

How does it work?

The researchers call their method "meta-hacking": they kept asking Copilot why an attack would not work, and the assistant named the undocumented settings that made it work. Pairing a query parameter with an undocumented "?autorun=1" parameter made Copilot execute an embedded prompt automatically. From there, OAuth connectors carried data out, and a booby-trapped web page, once summarized, wrote attacker instructions into the user's persistent memory store.

Why does it matter?

The memory-poisoning step is what makes CoSnitch worse than a normal data leak, because injected instructions shape every later session and stay put through a password reset. It also shows a defensive blind spot: an assistant's own reasoning can be talked into describing its guardrails. Security teams reviewing AI assistants now have a named example of connector access plus persistent memory turning one click into ongoing compromise.

Who is it for?

security teams and admins reviewing AI assistants

Frequently asked questions

Do Copilot users need to do anything now that CoSnitch is patched?: Microsoft shipped the CoSnitch patches on August 18, 2026, so the one-click auto-run path is closed without user action. Instructions already written into Copilot's memory store are a separate problem: Varonis reports they survive password changes and device re-enrollment, so anyone worried should review and delete saved Copilot memories by hand.
What data could CoSnitch reach?: CoSnitch reached whatever the victim's Copilot session was connected to. Varonis lists message bodies, subject lines and sender and recipient metadata from linked mail accounts, calendar titles, attendees, times and locations, file names and metadata summaries from Google Drive, full prior chat history, and the user's saved memory instructions.
Was CoSnitch used by real attackers?: Varonis Threat Labs found no evidence that CoSnitch was exploited in the wild before Microsoft's fix. The researchers reported the chain privately in December 2025 and held publication until the patch shipped roughly eight months later, on August 18, 2026.
Does CoSnitch affect Microsoft 365 Copilot at work?: The Varonis research targets Microsoft Copilot Personal, the consumer assistant at copilot.microsoft.com. The published reports do not state whether Microsoft 365 Copilot, the work version, is affected, so enterprise admins should treat that as unanswered rather than assume either way.