CoSnitch: one link drained Copilot's connected apps

A single link was enough. CVE-2026-24301, named CoSnitch by the researchers who found it, let an attacker run their own prompt inside a victim's Microsoft Copilot Personal session and walk out with data from connected Gmail, Drive, Calendar, and OneDrive accounts. Microsoft shipped the patch on August 18, 2026 — about eight months after Varonis Threat Labs reported it in December 2025.

What actually happened

Per Varonis Threat Labs, the attack chained three weaknesses rather than exploiting one bug:

• Automatic prompt execution. The documented ?q= parameter pre-fills a prompt. An undocumented ?autorun=1 parameter executed it on page load — no click inside the app, no confirmation.
• Unauthorized connector invocation. The injected prompt could query OAuth-connected services the user had linked, including Gmail, Google Drive, Calendar, and OneDrive.
• Built-in exfiltration. Results were encoded, often base64 to slip past content filters, into a URL that Copilot's own fetch capability then requested — delivering the data to an attacker-controlled webhook.

The researchers also demonstrated persistent memory modification through indirect prompt injection during web summarization. Varonis says it has seen no evidence the attack was exploited in the wild before the patch. Both Computerworld and The Hacker News covered the disclosure timeline.

Why it matters for your business

Nothing here required a novel exploit. It required an assistant with credentials, a URL parameter, and a user who clicked.

Your blast radius is your connector list, not your assistant. Copilot was the vehicle. The damage was proportional to how many OAuth grants the account held. Go look at what your team has connected to every AI assistant in the building — Copilot, ChatGPT, Claude, the browser extensions — and revoke the ones nobody uses weekly. That list is the actual attack surface, and most teams have never read theirs.

Undocumented parameters are shipped features. autorun=1 was not in any doc. It worked anyway. Treat every AI product's URL surface as capable of things the documentation does not describe, especially anything that turns a link into an executed instruction.

Eight months is the number to plan around. Varonis reported in December. The fix landed in August. Whatever your vendor's disclosure policy says, build for a window measured in quarters — which means the control you own is scope, not patch speed. Least privilege on connectors is the mitigation that works while you wait.

Consumer-tier AI is inside your business. This affected Copilot Personal. Staff signing personal assistants into work Gmail and Drive is the ordinary case, not the edge case. Write the rule down: what may be connected, by whom, to which account. Then check it against reality, because it currently is not.

Sources: Varonis Threat Labs, Computerworld, The Hacker News.