Microsoft Copilot Personal Flaws Could Let One Click Exfiltrate Data From Connected Apps
Varonis Threat Labs disclosed three vulnerabilities in Microsoft Copilot Personal (collectively named CoSnitch, CVE-2026-24301) that enable one-click data exfiltration from connected apps via a crafted URL The core flaw involves an undocumented `autorun=1` URL parameter that, when combined with the existing `q` parameter, triggers automatic prompt execution on page load without any user interaction The attack was discovered through "meta-hacking" — repeatedly asking Copilot itself why certain re
Analysis
TL;DR
- Varonis Threat Labs disclosed three vulnerabilities in Microsoft Copilot Personal (collectively named CoSnitch, CVE-2026-24301) that enable one-click data exfiltration from connected apps via a crafted URL
- The core flaw involves an undocumented
autorun=1URL parameter that, when combined with the existingqparameter, triggers automatic prompt execution on page load without any user interaction - The attack was discovered through "meta-hacking" — repeatedly asking Copilot itself why certain restrictions couldn't be bypassed, until the assistant revealed the parameter and its conditions
- A separate memory-poisoning vector allows attacker instructions to persist in Copilot's memory store through web summarization, surviving password changes and session revocations
- Microsoft patched the issues on August 18, 2026; no evidence of in-the-wild exploitation was found
Why It Matters
This research highlights a critical class of vulnerabilities in AI assistants that act as privileged intermediaries between users and connected services — a single malicious link can silently exfiltrate sensitive data from email, calendars, cloud storage, and chat history without the user's knowledge. It also demonstrates the emerging threat of "meta-hacking," where attackers exploit the assistant's own explanations to discover and weaponize undocumented features, raising fundamental questions about trust boundaries in AI-powered productivity tools.
Technical Details
- Automatic prompt execution: The
autorun=1parameter (discovered via meta-hacking) combined with theqparameter causes an attacker-supplied prompt to execute immediately on page load within the victim's authenticated Copilot session, with the same capabilities as a user-typed instruction - Exfiltration through connected services: The injected prompt queries already-authorized services (email, Google Drive, calendars, chat history), encodes retrieved data via base64, and uses Copilot's built-in URL fetch to send it to an attacker-controlled webhook — indistinguishable from normal summarization traffic at the network layer
- Persistent memory poisoning: A crafted web page, when summarized by Copilot, can write attacker instructions into the user's memory store; these injected memories survive password changes, session revocation, and device re-enrollment, remaining active until manually deleted
- Meta-hacking methodology: Researchers repeatedly asked Copilot why certain prompt behaviors couldn't be triggered without user interaction; each refusal included technical justifications that gradually revealed the
autorun=1parameter, its conditions, and its supposed protections - Scope: The vulnerabilities affect Copilot Personal (copilot.microsoft.com); the report does not confirm whether Microsoft 365 Copilot is affected, though related memory-write issues were separately documented for M365 under CVE-2026-24299
Industry Insight
- AI assistants with broad connected-service access should be treated as privileged insiders requiring the same level of access review, anomaly detection, and least-privilege enforcement as human accounts with sensitive data access
- The meta-hacking approach demonstrates that AI assistants' own explanations can become attack intelligence; developers should avoid exposing internal implementation details, parameter names, and security controls in assistant responses
- Memory/persistence features in AI assistants introduce long-lived attack surfaces that survive traditional credential rotation — security architectures must account for prompt-injection-based memory poisoning as a distinct threat class requiring dedicated detection and remediation controls
Disclaimer: The above content is generated by AI and is for reference only.