Copilot burned itself: how one click on a link turned Microsoft's AI assistant into a mail and file leak

Varonis Threat Labs researchers found a vulnerability in Microsoft Copilot Personal, which they dubbed CoSnitch — “snitch”: one specially collected link forced the assistant to leak data from linked Gmail, Google Drive and calendar, and the most piquant thing is that the secret parameter for the attack was given to the researchers by Copilot itself when it was too persistently questioned about its own limitations.

Link that thinks for you

The scheme looked almost insultingly simple, xrust states. The attacker generated a URL like copilot.microsoft.com/?q=<prompt>&autorun=1 — and when clicking on this link, the assistant immediately executed the command embedded in it, without even asking the user whether he really wanted this. No confirmation window, no “are you sure?” Just opened the page and Copilot is already working for the attacker.

Then the second part of the chain comes into play: many users have Copilot Personal connected to external services — mail, disk, calendar — via OAuth. Formally, these are legitimate permissions that the person himself once issued to the assistant. The vulnerability did not hack them — it simply forced Copilot to use the existing access not of its own free will, but according to someone else’s script, and steal the contents of correspondence or files through its own “retell web page” function. To security systems, it looked like a routine request to download a URL — nothing like data theft.

The third blow is to memory, which survives even a password reset

The most unpleasant part of the story is what happened next. The attack could write a malicious rule directly into Copilot's persistent memory. And this is where the real horror for the IT specialist begins: this recording, according to Varonis, survived password changes, termination of all sessions, and even reinstallation of the device. The user changes the password, thinking that he has solved the problem, and the instructions left by the attacker quietly live on in the assistant’s memory.

At the same time, not a single process, not a single network connection, not a single entry in the security log hinted that something went wrong. The only trace is in the Copilot memory interface itself, where the average user simply does not think to look.

How researchers forced AI to surrender itself

The method deserves special mention which Varonis found an undocumented autorun parameter. This is not reverse engineering the code or brute force requests — the team simply asked Copilot over and over again why the prompt could not run automatically without user interaction, and what would be technically required to make this possible. After a sufficient number of such questions, the assistant, trying to be helpful, himself outlined the structure of his own vulnerable function. Varonis called this approach “meta-hacking” — when a system is hacked not from the outside, but by interrogating it from the inside.

It’s funny that this is not the first such case by the same team of researchers: before CoSnitch, they also found Reprompt (bypassing security restrictions by repeating the same question) and SearchLeak (turning corporate Copilot into a leak channel through a regular web search) bugs in Copilot. The common feature of all three is that it only takes one click on a link to trigger, which does not reveal itself to the victim in any way.

What's the result

The vulnerability was assigned the number CVE-2026-24301, with a critical rating on the CVSS scale of 8.8 out of 10. Microsoft received a report from Varonis back in December 2025, and rolled out the patch only on August 18, 2026 — eight months later, and exclusively on the server side: users do not need to update the application itself. There is no data that the vulnerability was used in real attacks before the hole was closed — but the eight-month pause between the report of the vulnerability and its elimination is in itself a reason for questions.

Important detail: the problem specifically affected the consumer version — Copilot Personal, available at copilot.microsoft.com. Corporate Microsoft 365 Copilot Enterprise does not appear in this story; Microsoft representatives separately emphasized that the incident did not affect business users.

Why this is not the last such case

class=»notranslate»>__GTAG7__ The CoSnitch story fits into a broader and alarming trend: the deeper AI assistants are integrated into mail, disks, calendars and instant messengers, the more tempting they become as a single entry point for an attacker. Previously, to get to someone's correspondence, you had to break the mail itself or steal the password. Now, sometimes it is enough to deceive the assistant, who already has a legitimate key to this mail, and force him to do the dirty work himself, under the guise of the usual “tell me this page.”

The vulnerability is closed, but the case should be taken as a bell, and not as a closed page: for AI assistants that accumulate memory and connections with external services, the attack surface is growing faster than defense mechanisms can keep up with it.

Sources:
thehackernews.com
darkreading.com
varonis.com

Xrust Copilot burned itself: how one click on a link turned Microsoft’s AI assistant into a mail and file leak