Three weaknesses in a row allowed a prompt to be executed when a link was opened and data to be retrieved from connected services. Microsoft fixed on August 18.
Varonis Threat Labs released on August 18, 2026 a chain of three vulnerabilities in Copilot Personal, grouped under CVE-2026-24301 and named CoSnitch. The first link is an undocumented URL parameter that triggers the execution of a statement as soon as the page is loaded, without user validation: a simple click on a prepared link is enough. The second uses the already authorized OAuth connectors — Gmail, Google Drive, Google Agenda — to read the full body of messages, clear passwords included. The third is based on an indirect injection: instructions hidden in a web page summarized by the assistant change his persistent memory, which survives a change of password as if the device were re-enroled.
The manner in which the fault was found is at least as notable as the fault itself. The researchers describe a method they call "meta-hacking": rather than disassembling the code, they asked the assistant repeatedly about the reasons why automatic execution of prompts would be impossible, by reformulating each refusal in question of follow-up. It was Copilot who eventually explained his own operation and mentioned the undocumented parameter used as the front door.
Varonis had reported the problem to Microsoft in December 2025; the patch was delivered on the day of publication. No operations were observed before the patch. The team recommends auditing the authorized connectors and treating the assistant as a full privilege account, as most security tools currently have no visibility on this type of access.
Read the full article on the original source
Go to the source →