Microsoft has patched a critical Microsoft Copilot vulnerability that let an attacker silently pull data out of a victim's connected accounts with nothing more than a single click on a link. Varonis Threat Labs, which found and named the flaw CoSnitch, reported it to Microsoft in December 2025, and Microsoft shipped a full fix on August 18, 2026, tracked as CVE-2026-24301. The bug itself fits a pattern security researchers have been documenting all year in AI assistants that can read a user's connected data. What makes CoSnitch stand out is how part of it was found: Varonis says Copilot's own explanations, offered to argue the attack was not possible, ended up mapping out the exact mechanism that made it possible.
MicrosoftWhat CoSnitch actually did
According to Varonis, CoSnitch was not one bug but three weaknesses chained together, all inside Microsoft Copilot Personal, the consumer version of Copilot built into Windows and Edge. First, a URL carrying Copilot's normal search parameter alongside an undocumented parameter caused an attacker-written prompt to run automatically the moment the page loaded, with no click to confirm and no visible warning. Second, that prompt could reach into services the victim had already connected, such as email, cloud storage or a calendar, using OAuth access the person granted long before ever seeing the malicious link. Third, Copilot's own ability to fetch a URL let the encoded results travel straight to a server the attacker controlled. Varonis also described a related persistence issue: a crafted web page, when summarized by Copilot, could write instructions into the user's long-term memory store that survived a password change or a new device.
How one click became a silent data leak
CoSnitch did not require malware, a phishing form, or new permissions. It chained a hidden URL parameter, Copilot's existing account connections, and Copilot's own outbound fetch tool.
Every component in the chain, the link, the account access, and the outbound request, was a legitimate Copilot feature used exactly as designed.
None of the individual pieces required breaking Copilot's code. The link looked like an ordinary Copilot URL. The account access had already been granted for a legitimate reason. The outbound request used a feature Copilot needed anyway to browse the web on a user's behalf. CoSnitch worked by recombining features that were each doing their job.
Copilot explained its own flaw
The detail that set CoSnitch apart from a typical vulnerability report is the discovery method. Rather than reverse-engineering Copilot's code from scratch, Varonis researcher Lior Adar says the team repeatedly asked Copilot why the automatic prompt execution they suspected should not, in theory, be possible. Framed as ordinary follow-up questions rather than direct probing, those exchanges pulled technical justifications out of the assistant, and each refusal came with an explanation that mapped a little more of the underlying architecture. Eventually, mid-refusal, Copilot volunteered the name of the undocumented parameter that made the attack work, along with its history and the protections meant to disable it.
You don't exploit the model. You manipulate it into cooperating.
Lior Adar, Varonis Threat Labs
Varonis calls this technique meta-hacking, and it is a useful label for a class of risk distinct from a classic code exploit. The researchers were not attacking Copilot's software so much as social-engineering its reasoning, using the same conversational persistence that works on a person who is trying to be helpful. An assistant trained to explain itself, justify its refusals and answer follow-up questions can end up disclosing exactly the internal detail that a security boundary depends on keeping quiet, simply by trying to be thorough.
An eight-month gap, and why that is not unusual
Varonis says it found no evidence CoSnitch was exploited before the patch shipped, which is the best possible outcome for a bug that sat unresolved for roughly eight months. Microsoft addressed the automatic prompt execution piece in a partial fix around February 2026, which Varonis says meaningfully reduced the risk from the other two weaknesses, but the full chain was not closed until August 18. Microsoft has described the vulnerability as critical and said customers did not need to take any action once the fix shipped.
An eight-month window between report and full remediation looks long next to the industry's usual 90-day disclosure norm for conventional software bugs. It is worth reading in context rather than as a simple failure, though. CoSnitch touched features, connected-account access and web browsing, that are core to what makes Copilot useful, so a fix had to narrow the attack surface without breaking the product for legitimate use. That is a harder trade-off than patching a memory-safety bug in isolated code, and it is a tension every AI assistant vendor with similar connector features is going to face repeatedly, not a one-off. Microsoft's own qualification that Microsoft 365 Copilot Enterprise customers were not directly affected drew some pushback from analysts, since consumer Copilot flaws can still touch enterprise environments through an employee's personal account, an angle worth watching as Microsoft continues consolidating its Copilot products.
The third Copilot flaw this year
CoSnitch is not an isolated incident for Copilot, or for Varonis. It is the third one-click Copilot vulnerability the same research team has disclosed in 2026, after Reprompt in Copilot Personal, patched in January, and SearchLeak in Copilot Enterprise, patched in June. Each targeted a different surface, but the shape repeats: a crafted link, a chain of otherwise-legitimate features, and a route to exfiltrate data without the victim doing anything beyond clicking.
Three Copilot flaws, one research team, one year
CoSnitch is the third one-click Copilot vulnerability Varonis Threat Labs has disclosed in 2026, each patched months after it was reported.
Every case followed the same shape: one click, a chain of legitimate features, and a patch window measured in months.
That repetition is itself informative. It suggests the risk is not a single bug waiting to be squashed but a structural property of assistants built to read a user's connected accounts and follow instructions embedded in whatever content they process, a page, a search result, a summarized document. Security researchers generally group this under prompt injection and tool abuse: an AI system that treats untrusted content as a source of both information and instructions will occasionally act on instructions it should have ignored.
What it means for connecting AI to real data
For any organization giving an AI assistant access to email, files or other accounts, CoSnitch is a concrete illustration of a general principle: the risk scales with what the assistant can reach and act on, not just with how well its underlying model behaves. A few practical responses follow from that. Grant connectors the minimum access a task actually needs rather than broad, standing permissions. Treat any content an assistant summarizes or browses, not just direct chat input, as a potential source of instructions and monitor for unusual outbound requests. Keep a human in the loop for actions that move data outside the assistant's own interface, especially the first time a new kind of request appears. None of this is unique to Copilot; it applies to any assistant wired into connected accounts, and it is part of why scoped, auditable, model-agnostic access to tools and data is a design principle worth building around rather than retrofitting after an incident like this one.
The takeaway
CoSnitch is a reminder that a single click can be enough when an assistant is trusted to read connected accounts and act on what it finds there, and that the same conversational thoroughness that makes an AI assistant helpful can also be turned into a way of extracting how it works. Microsoft patched the flaw, found no evidence it was exploited, and closed a gap that took roughly eight months from report to full resolution. Varonis, for its part, has now found three one-click paths into Copilot in a single year, a pattern that says less about any one flaw and more about how much scrutiny AI assistants with real account access are going to keep drawing.
Sources:
- CoSnitch: When Your AI Assistant Becomes Its Own Whistleblower, Varonis
- Microsoft Copilot Personal Flaws Could Let One Click Exfiltrate Data From Connected Apps, The Hacker News
- Microsoft finally patches critical one-click Copilot vulnerability, almost eight months after learning of it, CSO Online
- 'CoSnitch' Attack Tricked Copilot Into Revealing Own Architecture, Dark Reading
- Copilot Revealed Its Own Vulnerability Through 'Meta-Hacking': Varonis, Security Boulevard
- Reprompt: The Single-Click Microsoft Copilot Attack that Silently Steals Your Personal Data, Varonis
- SearchLeak: How We Turned M365 Copilot Into a One-Click Data Exfiltration Weapon, Varonis
- Microsoft Patches Copilot SearchLeak Data-Theft Flaw, WinBuzzer
- Microsoft Copilot vulnerability allowed attackers to quietly steal your personal data with a single click, Windows Central
Image credits
Hero: Building 92, the visitor center on Microsoft's Redmond, Washington campus, photographed by Jiaqian AirplaneFan, via Wikimedia Commons, licensed under CC BY 3.0. In-body photograph: a Microsoft office building (Building 111) on the same Redmond campus, photographed by Runner1928, via Wikimedia Commons, licensed under CC BY-SA 4.0.