Microsoft Copilot Personal Flaws Expose User Data with One Click

Varonis Threat Labs has discovered three vulnerabilities in Microsoft Copilot Personal that could allow an attacker to silently pull data from connected apps and other information available to the victim's Copilot session with just a single click on a crafted link.

The flaws, collectively named CoSnitch, rely on an undocumented URL parameter that the assistant itself revealed during testing. Varonis reported the issue to Microsoft in December 2025, and patches were shipped on August 18, 2026, as CVE-2026-24301.

The researchers found no evidence of exploitation in the wild but demonstrated a one-click exfiltration path by injecting an attacker-supplied prompt into the victim's authenticated session. This prompt can query services the user has authorized, encode retrieved data, and send it to an attacker-controlled webhook using Copilot's built-in URL fetch.

Varonis also discovered a separate memory-poisoning path triggered through web summarization, where a crafted page could cause the assistant to write attacker instructions into the user's memory store. These instructions can persist even after changes in permissions or session revocation and remain active until explicitly removed from Copilot's memory settings.