Microsoft Copilot vulnerability CoSnitch read mail

"Varonis Threat Labs uncovered another one-click vulnerability in Microsoft Copilot Personal dubbed CoSnitch (critical, CVE-2026-24301), which quietly executes an attack chain that exfiltrates data from enterprises without obvious red flags."／"Automatic prompt execution: The ?q= URL parameter combined with an undocumented parameter causes any attacker-supplied prompt to execute instantly on page load: no click, no confirmation, no user action. One link is all it takes."／"Data exfiltration to external servers: An injected prompt can query the victim's connected apps (Gmail, Drive, Calendar, OneDrive), encode the results into a URL, and exfiltrate them via Copilot's built-in URL-fetch capability to an attacker-controlled webhook."／"Persistent memory poisoning via web summarization: A crafted webpage, when summarized by Copilot, injects attacker instructions into the victim's permanent memory store. The injection survives password changes, session revocation, and device re-enrollment, persisting forever." (intro / The vulnerabilities behind CoSnitch) — from Varonis Threat Labs

"CoSnitch is the third Microsoft Copilot flaw Varonis Threat Labs has discovered this year. Reprompt bypassed Copilot's guardrails just by asking twice. SearchLeak turned Microsoft 365 Copilot Enterprise into a silent exfiltration tool. All three share the same pattern: one click on a legitimate-looking link is enough."／"Varonis disclosed CoSnitch to Microsoft in December 2025, and patches were shipped on August 18, 2026. Varonis has seen no evidence that the attack has been exploited in the wild, and thanks Microsoft for their collaboration on the fix." (intro) — from Varonis Threat Labs

"Our researchers didn't have to reverse-engineer the flaw. The AI exposed the weakness during normal use"／"When we first asked Copilot how to execute a prompt without user interaction automatically, it explained that’s not how it works, user intent is required, and prompts don’t fire on their own."／"Instead of settling for that standard response, we deliberately kept pushing by reframing each question to seem like a natural follow-up rather than a probe. We asked about URL structure, deep links, and what happens when a page is loaded with input already in the field with the intent to make Copilot reason one layer deeper about its own architecture. Every answer narrowed our search. This is called meta-hacking, aka social engineering the reasoning engine itself. The resistance is part of the technique."／"You don’t exploit the model. You manipulate it into cooperating." (Meta-hacking: How we got Copilot to snitch on itself) — from Varonis Threat Labs

"Once execution is triggered, the prompt has the same capabilities as any legitimate user instruction."／"Copilot then disclosed an undocumented URL parameter — unprompted, mid-refusal — including its historical behavior and every protection put in place to disable it"／"We built the URL exactly as described. With no click or confirmation from the user, the prompt was successfully executed automatically"／"Note: ?q= alone only pre-fills the input the user would still need to press Enter. It is ?autorun=1 that enables automatic execution on page load. Both parameters must be present for the attack to work silently." (The steps behind meta-hacking / Vulnerability 1: Automatic prompt execution) — from Varonis Threat Labs

"Once Copilot has OAuth access to a user’s Gmail account, it can read everything in that inbox, not summaries, not metadata, but full message bodies. In our testing, this included emails containing credentials shared over email, internal system passwords, password reset links, and sensitive personal information that users had never considered at risk because it was “just in email.”"／"This is not a flaw in Gmail or OAuth. The user authorized Copilot to read their email, which it did."／"The key assumption the system makes is that connector invocations are user-initiated. CoSnitch breaks that assumption."／"the prompt instructs Copilot to encode the collected data into a URL path and fetch it"／"The base64 encoding compresses the payload into a URL-safe string and helps avoid triggering content filters that scan for sensitive patterns, such as passwords or API keys, in outbound requests."／"Email content, subject lines, sender/recipient metadata, message bodies"／"Google Calendar Meeting titles, attendees, times, and locations"／"Google Drive File names, metadata summaries"／"Copilot Chat History Full prior conversation content"／"Copilot Memory Persistent cross-session context, saved instructions, user-defined rules"／"From the network layer, this is a standard outbound HTTPS GET request, identical to any legitimate URL fetch Copilot performs when summarizing a webpage. No anomalous headers, no unusual ports, no flaggable payload. Security tooling sees Copilot doing exactly what it always does: fetching a URL." (Vulnerability 2; each row of the table above comes from a cell of the Data exfiltrated in testing table in that section) — from Varonis Threat Labs

"Indirect prompt injection is different because the attacker plants instructions in external content that the model will process on the victim’s behalf."／"Copilot does not distinguish between content to summarize and instructions to follow when processing external page content. If the page contains natural language instructions formatted in a way the model interprets as directives, those instructions execute."／"Once the memory is written, the attacker’s instructions are permanent. Copilot’s memory has no expiration. It does not reset between sessions and does not clear on logout, and is never automatically deleted or overwritten. The injected instruction remains active in every future Copilot conversation for that user unless the user manually navigates to the memory settings and deletes it. Most users never do this, with many users not even knowing it exists."／"No forensic footprint: The memory write produces no process, file, network connection, or log entry that security tooling would flag. The only record is in Copilot’s memory UI, which users rarely inspect"／"Once an attacker can write to your Copilot memory, they can shape what Copilot tells you, including suppressing CVE warnings or presenting a known vulnerability as safe." (Vulnerability 3: Indirect prompt injection via web summarization → persistent memory modification / Impact: Unauthorized memory modification) — from Varonis Threat Labs

"The takeaway from CoSnitch isn’t, “stop using Copilot.”"／"Audit connector configurations: Review which apps are connected to Copilot and whether each connection is actively necessary. Fewer connections mean a smaller blast radius."／"Treat Copilot as a privileged insider: Apply the same access review and anomaly detection you would to a human employee with broad data access."／"Review link-delivery risks: The attack chain requires the victim to click a link. Consider whether AI assistant URLs from external sources need additional scrutiny."／"Confirm whether your current tooling would detect unusual data access patterns originating from Copilot most tools have a blind spot here."／"Be cautious with links that open AI tools: If a link pre-fills a prompt, read what it says before it runs."／"Watch for unexpected behavior: If Copilot fetches URLs you didn’t request or produces unexpected output, close the session and report it."／"Keep your connected apps minimal: Only connect services you actively use."／"The victim clicks the attacker’s crafted URL (delivered via email, chat, phishing page, QR code, etc.)"／"CoSnitch is three vulnerabilities, one click, and zero anomalous signals."／"The novel meta-hacking technique that uncovered CoSnitch — using the AI’s own reasoning to surface its hidden internals — applies to any agentic platform with a natural language interface." (How to protect your organization / The bottom line; the link-delivery fragment is from Vulnerability 1: Automatic prompt execution) — from Varonis Threat Labs