Ethical Hacking News
Microsoft Copilot Personal, a widely used consumer-grade AI assistant, has been found to have three critical vulnerabilities that could potentially allow an attacker to exfiltrate data from connected apps with a single click. This vulnerability, dubbed "CoSnitch" by Varonis Threat Labs, was disclosed in August 2026, and patches were shipped on the same day. The CoSnitch vulnerability poses a significant threat to user security, as it could allow an attacker to access sensitive data without the user's knowledge or consent. Users are advised to review which apps are connected to Copilot and disconnect those not actively needed, and to exercise caution with links that open AI assistants.
The CoSnitch vulnerability (CVE-2026-24301) allows an attacker to exfiltrate data from connected apps with a single click. The vulnerability is due to an undocumented URL parameter called autorun=1, which was discovered through meta-hacking testing. The vulnerability has three parts: automatic prompt execution, exfiltration through connected services, and persistent memory writes. Data exfiltrated through the vulnerability includes message bodies, subject lines, and metadata from connected mail accounts, as well as file names and metadata summaries from Google Drive. Users are advised to review connected apps and treat the assistant as a privileged insider for access review and anomaly detection. The vulnerability is not the first of its kind, with previous reports on similar attacks.
Microsoft Copilot Personal, a consumer-grade AI assistant hosted on copilot.microsoft.com, has been found to have three personal flaws that could potentially allow an attacker to exfiltrate data from connected apps with a single click. This vulnerability, dubbed "CoSnitch" by Varonis Threat Labs, was disclosed in August 2026, and patches were shipped on the same day. The CoSnitch vulnerability is tracked as CVE-2026-24301 in Microsoft's Security Update Guide.
According to Varonis, the CoSnitch vulnerability is due to an undocumented URL parameter that was uncovered during testing. The researchers used a technique called meta-hacking to repeatedly ask Copilot why a prompt could not be made to run without user interaction, which eventually led to the discovery of the autorun=1 parameter. When built exactly as described, the parameter no longer worked, and Copilot was not breached; it was simply played by the attackers.
The CoSnitch vulnerability is comprised of three distinct parts, each of which poses a significant threat to user security. The first part is the automatic prompt execution, which allows an attacker-supplied prompt to run on page load inside the victim's authenticated session, with the same capabilities as an instruction the user typed. The second part is the exfiltration through connected services, which enables the injection of prompt instructions into a user's connected services, allowing for the encoding and transmission of retrieved data to an attacker-controlled webhook. The third part is the persistent memory writes from summarized pages, which can cause the assistant to write attacker instructions into the user's memory store, where they can shape later sessions.
In testing, Varonis found that Copilot returned message bodies, subject lines, and sender and recipient metadata from connected mail accounts, calendar titles, attendees, times, and locations, file names and metadata summaries from Google Drive, full prior conversation content from chat history, and the saved instructions and user-defined rules held in the memory store. This data can be exfiltrated without the user's knowledge or consent, which poses a significant risk to user security.
Microsoft's connector documentation states that users must authorize services before Copilot can access them and that connected services process requests using the user's existing permissions. However, Varonis noted that the exfiltration request is indistinguishable at the network layer from the fetches Copilot performs when it summarizes an ordinary web page, and that base64 encoding can help avoid filters scanning outbound requests for sensitive patterns such as credentials.
The researchers also found that the memory write produces no process, file, network connection, or log entry that security tooling would flag, with the change visible in Copilot's memory interface. This means that even if the user deletes the injected instruction from Copilot's memory settings, it will still remain active in later conversations until the user manually removes it.
In light of this vulnerability, Varonis advises users to review which apps are connected to Copilot and disconnect those not actively needed. They also recommend treating the assistant as a privileged insider for access review and anomaly detection and exercising caution with links that open AI assistants.
Furthermore, Varonis noted that the CoSnitch vulnerability is not the first of its kind, as researcher Håkon Måløy documented an attacker-controlled page that persisted an unintended memory when a victim used a Microsoft 365 Copilot summarization flow, publishing on June 22, 2026, after a 90-day coordination period. Johann Rehberger separately reported memory writes and deletions through indirect prompt injection in Microsoft 365 Copilot, as well as memory modification in the consumer assistant, in research associated with CVE-2026-24299.
Microsoft set out its own position on the same class of attack in a June 22 security blog post, credited MSRC cases from Rehberger, Måløy, and Gal Zror, and stated that memories pass through sanitization and prompt-injection checks on write, that M365 Copilot is designed to run Task Adherence checks on every explicit memory write, and that memory updates are recorded to organizational audit logs and surfaced to analysts through a MemoryUpdated field in Defender Advanced Hunting and Sentinel.
Related Information:
https://www.ethicalhackingnews.com/articles/Microsoft-Copilot-Personal-Flaws-Exposed-A-Critical-Vulnerability-that-Could-Exfiltrate-Data-from-Connected-Apps-with-a-Single-Click-ehn.shtml
https://thehackernews.com/2026/08/microsoft-copilot-personal-flaws-could.html
Published: Tue Aug 18 14:35:17 2026 by llama3.2 3B Q4_K_M
