Microsoft patches critical one-click Copilot flaw 'CoSnitch'

What happened? On 18 August 2026 Microsoft patched the critical Copilot vulnerability CVE-2026-24301 — reported by Varonis Threat Labs back in December 2025, roughly eight months earlier. The researchers named the attack "CoSnitch"; their report is titled "When Your AI Assistant Becomes Its Own Whistleblower".

How did the attack work? CoSnitch chained three weaknesses in Copilot Personal: an undocumented URL parameter (autorun=1) executed crafted prompts automatically on page load — a single click on a link was enough. The malicious prompt could then use connected OAuth apps to read emails, file names and appointments from Gmail, Google Drive and Calendar and send them to attacker-controlled webhooks.

What made it especially dangerous? The third component: memory poisoning. Via web summarisation, instructions could be permanently injected into a user's memory store — surviving password changes and session revocation. The discovery method is remarkable too: researchers got Copilot to disclose its own architecture, including undocumented parameters, through strategic questioning.

Was there any damage? According to Microsoft and Varonis there is no evidence of exploitation in the wild. Criticism remains: CSO Online highlights the nearly eight-month gap between report and patch.

What is the lesson? AI assistants with OAuth access to mail, calendar and files are a new, high-value attack target: prompt injection becomes data exfiltration. Companies should regularly review AI assistant permissions, audit memory features and treat URL-parameter execution without user confirmation as a red flag.