Microsoft Takes Eight Months to Fully Patch 'CoSnitch,' a One-Click Copilot Flaw That Stole Data From Gmail and Drive

Microsoft shipped the full fix for CVE-2026-24301 — a critical Copilot vulnerability dubbed “CoSnitch” — on August 18, nearly eight months after Varonis Threat Labs reported it on December 31. One click on a malicious link was enough to silently drain data from a victim’s connected accounts.

CoSnitch chained three separate weaknesses in Microsoft Copilot Personal:

1. Automatic prompt execution. An undocumented URL parameter, combined with Copilot’s standard ?q= query parameter, made an attacker-crafted prompt run the moment the victim’s browser loaded the page. No confirmation, no interaction beyond the click.
2. Data exfiltration. The auto-executed prompt could query Copilot’s connected apps — Gmail, Google Drive, Calendar, OneDrive — and ship the results to an attacker-controlled server.
3. Persistent memory poisoning. Through web summarization, attackers could plant instructions in Copilot’s memory that survived password changes and even device re-enrollment.

That third stage is the nastiest part. Rotating credentials is the standard incident response after a suspected compromise. Here it accomplished nothing, because the implant lived in the assistant’s memory, not the session.

The discovery method deserves its own headline. Varonis researchers used what they call “meta-hacking”: they repeatedly asked Copilot to explain why automatic prompt execution was supposedly impossible. Each refusal came with a technical justification — and those justifications, assembled together, mapped Copilot’s architecture well enough to break it. The AI documented its own attack surface, one polite denial at a time.

The timeline is the other indictment. Microsoft issued a partial patch on February 1 that closed the auto-execution hole, but the complete fix took until August 18. For a critical, one-click flaw in a consumer product connected to users’ email and cloud storage, an eight-month remediation window is hard to defend. The only mitigating fact: no evidence of in-the-wild exploitation surfaced before the patch.

CoSnitch is Varonis’s third Copilot flaw this year, after Reprompt (guardrail bypass by repeating a question) and SearchLeak (turning Microsoft 365 Copilot Enterprise into a covert exfiltration channel). The pattern is structural, not incidental. As security analysts noted, the capabilities CoSnitch exploited — reading your mail, summarizing the web, remembering context across sessions — are exactly the features Microsoft sells as Copilot’s value. You cannot fully patch away the product.

What to do: the fix is server-side, so there is no update to install. But if your organization allows Copilot Personal with connected Google or Microsoft accounts, audit which connectors are enabled, and treat assistant memory as an attack surface in incident response playbooks — credential rotation alone no longer clears a compromised AI session.

Sources

• CSO Online