Microsoft Patches 'CoSnitch' Flaws That Let One-Click Links Steal User Data

Microsoft has patched a critical chain of vulnerabilities in Copilot Personal that could have allowed attackers to silently steal private user data via a single malicious link. The flaws, dubbed "CoSnitch" by the researchers who found them, enabled the automatic execution of prompts to exfiltrate information from connected third-party applications.

Discovered by Varonis Threat Labs, the attack leveraged a crafted URL containing a standard 'q' parameter for the prompt and an undocumented 'autorun=1' parameter. This combination allowed an attacker to bypass typical user interaction requirements, executing commands the moment a user clicked the link. According to Varonis, the vulnerabilities—tracked as CVE-2026-24301—could be used to silently exfiltrate data from OAuth connectors, specifically targeting Gmail, Google Drive, and Google Calendar, as well as the AI's own chat history. The flaws also permitted the poisoning of the assistant's persistent memory. Microsoft deployed a patch to resolve these issues on August 18, 2026.

The 'Meta-Hacking' Discovery

The vulnerabilities were uncovered through a process the researchers called "meta-hacking." Rather than using traditional exploit methods, the team tricked Copilot into revealing its own internal parameters and security protections by repeatedly questioning why specific attack vectors would fail. Lior Adar, a senior security researcher at Varonis, noted that these attack chains allowed him to trick the assistant into leaking sensitive internal configuration details. This discovery follows a pattern of previous Varonis research into one-click AI attacks, including similar vulnerabilities known as 'SearchLeak' and 'Reprompt.'

Architectural Risks in AI

The CoSnitch vulnerability highlights a fundamental architectural flaw in how large language models (LLMs) are integrated with personal data. Currently, there is often no strict boundary between raw data and system instructions, meaning a trusted AI assistant can be weaponized to use its own authorized access against the user. By turning a helpful tool into a silent exfiltration agent, attackers can bypass traditional security perimeters using simple phishing links. As Varonis put it, Copilot "wasn't breached; it was played."

What to Watch

While Microsoft has addressed the specific CVE-2026-24301 flaws, the incident underscores the ongoing risk of prompt injection and parameter manipulation in AI ecosystems. Security professionals are now watching for similar undocumented parameters in other AI assistants that may allow for the bypass of user consent. Users are encouraged to review the permissions granted to AI connectors and remain cautious of unsolicited links, even those appearing to lead to trusted AI services.