Microsoft Copilot Personal Flaws Could Let One Click Exfiltrate Data From Connected Apps

Severity
High

Detail

Security researchers from Varonis Threat Labs have disclosed three vulnerabilities in Microsoft Copilot Personal that could allow attackers to steal sensitive information from connected applications through a single malicious link.

The vulnerabilities, collectively named CoSnitch, include a flaw tracked as CVE-2026-24301. Microsoft released fixes for the reported issues on August 18, 2026. The research specifically concerns Copilot Personal at copilot.microsoft.com and does not indicate that the same behavior affected Microsoft 365 Copilot.

How?

The attack abuses URL parameters that can cause an attacker-controlled prompt to execute automatically when a victim opens a specially crafted link. Researchers discovered that combining the q parameter with an undocumented autorun=1 parameter could cause the malicious prompt to run without requiring the victim to submit it manually.

Once executed within the victim’s authenticated Copilot session, the malicious prompt can instruct Copilot to access information from services that the user has already connected and authorized. Researchers demonstrated access to email messages and metadata, calendar information, Google Drive file information, previous conversation content, and Copilot memory.

The stolen information can then be encoded and transmitted to an attacker-controlled server using Copilot’s existing web-fetch functionality. Because the requests can resemble normal Copilot web activity, the exfiltration may be difficult to distinguish from legitimate traffic using network monitoring alone.

A separate vulnerability allows specially crafted web pages summarized by Copilot to inject instructions into the user’s Copilot memory. The malicious instructions can persist across future sessions until the user removes them from Copilot’s memory settings.

The researchers reported the vulnerabilities to Microsoft in December 2025, and Microsoft shipped fixes on August 18, 2026. Varonis stated that it found no evidence that the vulnerabilities had been exploited in the wild.

Recommendation

Organizations should implement a layered security approach to reduce the risk of Copilot-related data exposure:

• Ensure Microsoft Copilot applications and services are updated with the latest security fixes.
• Review connected applications and remove integrations that are not required.
• Avoid opening suspicious or unexpected links that directly launch AI assistants.
• Monitor for unusual Copilot activity, unexpected data access, and suspicious outbound connections.
• Apply least-privilege access to connected applications and sensitive data.
• Educate users about prompt-injection and AI-assisted phishing techniques.

Source

https://thehackernews.com/2026/08/microsoft-copilot-personal-flaws-could.html