Microsoft Copilot Personal Flaws Enable One-Click Data Exfiltration and Memory Poisoning

Security researchers from Varonis Threat Labs disclosed three vulnerabilities affecting Microsoft Copilot Personal that could allow attackers to abuse a victim's authenticated Copilot session.

The vulnerabilities, collectively referred to as CoSnitch, can allow a crafted link to automatically execute an attacker-controlled prompt, retrieve information from services already connected to Copilot, and send the collected information to an attacker-controlled endpoint. A separate attack path can also manipulate Copilot's persistent memory through malicious web content.

Microsoft released fixes for the vulnerabilities on August 18, 2026. The research specifically concerns Copilot Personal and does not state that the same behavior affected Microsoft 365 Copilot.

Key Highlights

• Vulnerability family: CoSnitch
• Affected product: Microsoft Copilot Personal
• CVE: CVE-2026-24301
• Attack type: One-click prompt injection and data exfiltration
• User interaction: A single click on a crafted link
• Authentication: Victim must have an authenticated Copilot session
• Connected applications can be queried using the victim's existing permissions
• Data can be encoded and sent through Copilot's URL-fetch capability
• Separate attack path can poison Copilot's persistent memory
• Microsoft released fixes on August 18, 2026
• No evidence of in-the-wild exploitation was identified by Varonis.

CoSnitch Vulnerabilities

Varonis grouped the findings into three primary behaviors:

1. Automatic prompt execution
2. Exfiltration through connected services
3. Persistent memory manipulation

The first two form the one-click data-exfiltration attack chain, while the third represents a separate memory-poisoning technique.

Automatic Prompt Execution

The attack uses specially crafted Copilot URLs containing parameters that influence how prompts are processed.

The researchers identified an undocumented parameter:

autorun=1

When combined with the existing:

q=

parameter, the attacker-controlled prompt can execute automatically when the victim opens the crafted URL.

The victim does not need to manually type the malicious prompt.

Varonis reported that the prompt could continue executing even if the victim closed the Copilot tab immediately after the page loaded.

One-Click Data Exfiltration

Once the malicious prompt executes inside the victim's authenticated Copilot session, it can instruct Copilot to access services that the victim has already connected.

Importantly, the attack does not grant Copilot additional permissions.

Instead, it abuses the permissions that the victim has already authorized.

The research demonstrated access to information including:

• Email message bodies
• Email subject lines
• Sender and recipient metadata
• Calendar titles
• Calendar attendees
• Calendar times and locations
• Google Drive file names
• File metadata
• Prior Copilot conversation content
• Saved Copilot instructions
• User-defined memory rules

Existing Permissions Are Abused

Microsoft's connector model allows Copilot to interact with connected services using the user's existing permissions.

Therefore, the attack does not necessarily require stealing the victim's credentials.

Instead, the malicious prompt attempts to make the AI assistant perform actions using access that has already been granted to the user's Copilot session.

This represents an important security distinction:

The attacker is abusing delegated access rather than directly stealing the underlying credentials.

Data Exfiltration Through URL Fetch

After retrieving information, the malicious prompt can instruct Copilot to encode the data and use Copilot's URL-fetch capability to send it to an attacker-controlled webhook.

Varonis noted that this network traffic can resemble normal URL fetching performed by Copilot.

This creates an additional detection challenge because conventional network monitoring may have difficulty distinguishing malicious data exfiltration from legitimate Copilot activity.

Base64 Encoding

The researchers also demonstrated that retrieved information could be encoded before being transmitted.

Base64 encoding can make sensitive strings less obvious to simple content filters searching for terms such as:

• Password
• Credential
• Token
• Secret

This technique does not provide encryption, but it can reduce the effectiveness of basic pattern-based inspection.

Copilot Memory Poisoning

The third vulnerability follows a different attack path.

A malicious webpage can contain instructions that influence Copilot when the victim asks the assistant to summarize the page.

The attacker-controlled instructions can cause Copilot to write malicious content into its persistent memory.

Once stored, the injected instructions can influence subsequent Copilot sessions.

Persistence of Malicious Memory

The memory manipulation is particularly concerning because the injected instruction can persist beyond the original browsing session.

According to Varonis, the injected memory survived:

• Password changes
• Session revocation
• Device re-enrollment

The malicious instruction remained active until the user explicitly removed it through Copilot's memory settings.

Why Memory Poisoning Matters

AI assistants increasingly retain user preferences, instructions and contextual information.

If attackers can manipulate that memory, they may influence future interactions without needing to repeat the original attack.

This creates a new persistence category:

Prompt Injection → Persistent AI Memory → Future Session Manipulation

Unlike traditional malware persistence, the attacker may not need to create a file, process, registry entry or scheduled task on the endpoint.

Detection Challenges

The memory attack has an unusual characteristic.

Varonis reported that the memory modification did not generate a conventional:

• Process
• File
• Network connection
• Security-tool alert

The change was instead visible through the Copilot memory interface.

This creates a significant challenge for traditional endpoint-focused security monitoring.

Detection and Hunting Opportunities

Security teams should monitor for:

• Suspicious Copilot URLs
• Unexpected autorun=1 parameters
• Copilot URLs containing attacker-controlled q parameters
• Unexpected external links opening Copilot
• Copilot activity involving unusual connected services
• Unexpected URL-fetch activity
• Large or unusual outbound requests originating from Copilot-related infrastructure
• Unexpected access to connected email or calendar data
• Suspicious changes to Copilot memory
• Unexpected persistent instructions
• Malicious webpages designed specifically for Copilot summarization
• Unusual use of connected applications by Copilot
• Suspicious webhook destinations associated with AI-assisted activity

Recommended Mitigations

1. Ensure Microsoft Copilot Personal users are using the remediated service.
2. Review applications connected to Copilot.
3. Disconnect services that are not actively required.
4. Review Copilot memory for unexpected instructions or modifications.
5. Remove suspicious or unknown memory entries.
6. Treat links that directly open AI assistants with caution.
7. Monitor externally shared Copilot links.
8. Restrict unnecessary third-party application integrations.
9. Apply least privilege to connected services.
10. Monitor unusual access to email, calendar and cloud-storage data.
11. Educate users about AI-specific phishing and prompt-injection attacks.
12. Investigate suspicious Copilot activity following a malicious-link click.

Threat Assessment

The CoSnitch vulnerabilities demonstrate a new class of AI-assisted attacks in which the attacker does not necessarily compromise the endpoint or steal credentials.

Instead, the attacker manipulates an authenticated AI assistant into using legitimate permissions on behalf of the victim.

This creates a security model where AI assistants should increasingly be treated as privileged applications capable of accessing sensitive information.

Conclusion

Organizations should consider AI assistants part of their identity and data-security architecture.

Connected applications, delegated permissions and persistent AI memory can become attack surfaces just like traditional APIs and cloud services.

Security teams should therefore combine AI activity monitoring, identity controls, connected-application governance and prompt-injection defenses rather than relying solely on endpoint security.