Overview
- Varonis Threat Labs disclosed the flaw chain called CoSnitch after using a “meta-hacking” method to coax Copilot into revealing an undocumented autorun=1 URL parameter that triggers prompt execution without a user gesture.
- The exploited flow paired autorun=1 with the existing q parameter so a clicked link could load copilot.microsoft.com in an authenticated session and run attacker-supplied prompts to query connected apps.
- In demonstrations, injected prompts used Copilot’s built-in web fetch to encode retrieved data as base64 and send it to attacker-controlled webhooks, enabling one-click exfiltration of email, calendar, Drive metadata and other permitted content.
- A separate attack path used web summarization to write attacker instructions into Copilot’s persistent memory store that could survive password changes and session revocation until the user deleted them.
- Microsoft implemented server-side fixes and assigned CVE-2026-24301 after Varonis reported the issue in December 2025 and publicly disclosed results on August 18, 2026, and Varonis said it found no evidence of active exploitation while warning the technique could apply to other agentic assistants.