Varonis Threat Labs disclosed three vulnerabilities in Microsoft Copilot Personal this week, collectively named CoSnitch and tracked in Microsoft’s Security Update Guide as CVE-2026-24301. A single click on a crafted link could make the assistant run an attacker’s prompt inside the victim’s authenticated session, query the services that user had already connected, and quietly ship the results to a server the attacker controlled.
Microsoft shipped the fix on 18 August 2026. Varonis says it reported the issue in December 2025 — roughly eight months. Microsoft has said the flaw affected only Copilot Personal, the consumer assistant at copilot.microsoft.com, with no customer action required because the fix is already deployed. The researchers found no evidence of exploitation in the wild.
The way they found it is the part worth sitting with. They repeatedly asked Copilot why a prompt could not be made to run without a user gesture. Each refusal came wrapped in a technical justification, and the assistant eventually volunteered the name of an undocumented URL parameter, autorun=1, plus the session conditions under which it worked. The researchers built the URL exactly as described. It fired. Varonis’ own summary: Copilot “wasn’t breached; it was played.”
Our take: The exfiltration path is patched. The memory problem is a different shape. Varonis says instructions written into Copilot’s memory store survive password changes, session revocation and device re-enrolment, and stay active until the user deletes them from memory settings — and its disclosure does not state whether Microsoft’s remediation retroactively removed entries created before 18 August. A patched door does not empty the room behind it.
What the three flaws actually did
Varonis grouped the findings into three parts. Two chain together into the one-click path; the third is separate.
- Automatic execution. The
autorun=1parameter paired with the existingqparameter caused an attacker-supplied prompt to run on page load. Varonis saysqalone only pre-fills the input box — both had to be present. Once execution began, the prompt ran to completion even if the victim closed the tab immediately after the page loaded. - Exfiltration through connected services. The injected prompt could query services the user had already authorised, encode what it retrieved, and use Copilot’s built-in URL fetch to send it onward. Testing pulled mail bodies and sender metadata, calendar titles and attendees, Google Drive file names, prior conversation content, and the saved rules in the memory store itself. The technique granted Copilot no new permissions — it borrowed the ones the user had already given.
- Persistent memory writes. Separately, a crafted web page, once summarised by Copilot, could cause the assistant to write attacker instructions into the user’s memory store, where they shape later sessions.
Varonis notes the outbound request is indistinguishable at the network layer from the fetches Copilot makes when summarising an ordinary page. The memory write produces no process, no file, no network connection and no log entry that security tooling would flag. It is visible in exactly one place: Copilot’s memory interface.
Not an isolated finding
Researchers Håkon Måløy and Johann Rehberger have both reported Copilot memory manipulation this year, Rehberger’s work associated with CVE-2026-24299. Microsoft set out its position on the attack class in a 22 June security post — scoped to Microsoft 365, not the consumer product. There, it says memories pass sanitisation and prompt-injection checks on write, that Task Adherence checks run on every explicit memory write, and that updates land in organisational audit logs surfaced through a MemoryUpdated field in Defender and Sentinel. No equivalent audit trail is described for the consumer assistant.
What to watch
- Whether anyone addresses pre-patch memories. Retroactive cleanup is the remediation question that matters here, and it has not been answered publicly.
- The URL-parameter pattern spreading. The same Varonis team disclosed RovoBlast less than two weeks earlier — a one-click attack on Atlassian’s Rovo assistant abusing a
rovoChatPromptparameter, which Atlassian fixed before publication. Prompt-carrying URL parameters are becoming a standard assistant feature and a standard attack surface at the same time. - The consumer/enterprise logging gap. Enterprise Copilot memory writes are logged and surfaced to security tooling. Personal ones are not. That gap is the story next time.
The five-minute version for your own account
Varonis’ advice is unglamorous and correct: open your assistant’s connected-apps list and disconnect anything you are not actively using; open the memory settings and read every entry, deleting anything you do not remember creating; and treat a link that opens an AI assistant with the same suspicion you would give a link that opens a login page. The assistant holds your permissions. Anything that can steer it is standing exactly where you stand.