Cybersecurity firm **Varonis Threat Labs** has disclosed three critical vulnerabilities in **Microsoft Copilot Personal**, the consumer-facing AI assistant available at copilot.microsoft.com. Tracked as **CVE-2026-24301**, these flaws, collectively named **CoSnitch**, leverage an undocumented URL parameter to enable one-click data exfiltration and persistent memory poisoning.  ### The Discovery: Meta-Hacking Copilot **Varonis** researchers discovered these vulnerabilities through an innovative technique they call "meta-hacking." By repeatedly asking **Copilot** why a prompt couldn't run without user interaction, the assistant eventually divulged an `autorun=1` parameter along with conditions for its use. Despite **Copilot** stating the parameter was disabled, the researchers successfully executed it by meticulously crafting the URL as described. "**Copilot** wasn't breached; it was played," **Varonis** stated in its report. ### CoSnitch: A Trio of Vulnerabilities The **CoSnitch** vulnerabilities are grouped into three distinct issues: 1. **Automatic Prompt Execution:** Combining the `autorun=1` and `q` parameters in a URL causes an attacker-supplied prompt to execute automatically upon page load within the victim's authenticated **Copilot** session. This grants the attacker the same capabilities as if the user had typed the instruction themselves. 2. **Exfiltration Through Connected Services:** Once a malicious prompt is executed, it can query services the user has already authorized (e.g., email, calendar, cloud storage). The retrieved data can then be encoded and exfiltrated to an attacker-controlled webhook using **Copilot**'s built-in URL fetching capabilities. Importantly, this technique does not grant **Copilot** new permissions but leverages existing user access. 3. **Persistent Memory Writes from Summarized Pages:** A separate vulnerability allows a specially crafted web page, when summarized by **Copilot**, to inject attacker instructions directly into the user's memory store. These instructions can persist across sessions, even surviving password changes and device re-enrollment, and influence future **Copilot** interactions until manually removed by the user. ### Data at Risk During testing, **Varonis** successfully retrieved a wide array of sensitive information, including email message bodies, subject lines, sender/recipient metadata, calendar details (titles, attendees, times, locations), file names and metadata from **Google Drive**, full chat history, and saved instructions from **Copilot**'s memory store.  **Microsoft**'s documentation confirms that **Copilot** operates within the user's existing permissions for connected services, meaning it does not expand access. **Varonis** noted that exfiltration requests are network-level indistinguishable from legitimate **Copilot** fetches, and Base64 encoding can further mask sensitive data from network filters. ### Persistent Memory and Prior Research The memory injection aspect of **CoSnitch** is particularly concerning due to its persistence and stealth. Injected instructions remain active until explicitly deleted by the user, and the changes produce no detectable process, file, network, or log entries for security tooling. This isn't the first time **Copilot**'s memory handling has come under scrutiny. Researcher **Håkon Måløy** previously documented a similar issue in **Microsoft 365 Copilot** (the enterprise version) where an attacker-controlled page could inject unintended memory via summarization flows. Separately, **Johann Rehberger** reported memory writes and deletions through indirect prompt injection in both **Microsoft 365 Copilot** and the consumer assistant, associated with **CVE-2026-24299**. **Microsoft** acknowledged this class of attack in a June 22 security blog post, detailing its mitigations for **Microsoft 365 Copilot**, including sanitization, prompt-injection checks on write, and auditing via **Defender Advanced Hunting** and **Sentinel**. ### Mitigation and Recommendations **Varonis** reported these issues to **Microsoft** in December 2025, and patches were rolled out on August 18, 2026. While **Varonis** found no evidence of in-the-wild exploitation, they advise users and IT security professionals to take the following precautions: * **Review Connected Apps:** Regularly check which applications are connected to **Copilot** and disconnect any that are not actively needed. * **Treat as Privileged Insider:** Consider **Copilot** as a privileged insider when conducting access reviews and anomaly detection. * **Exercise Caution with Links:** Be wary of clicking links that automatically open or interact with AI assistants. **Varonis** did not specify a client-side update for users to install, and it remains unclear whether **Microsoft**'s remediation retroactively removed memory entries created before the fix. This disclosure follows **Varonis**'s recent report on **RovoBlast**, a one-click attack against **Atlassian Rovo** that similarly abused a URL parameter to inject attacker-controlled instructions. **Atlassian** reportedly fixed that issue prior to public disclosure.