Microsoft patched consumer-facing Copilot on August 18, 2026 for CVE-2026-24301, a high-severity flaw rated 8.8 out of 10. Varonis linked it to CoSnitch, a three-step attack chain.
According to Varonis, one click on a crafted Copilot link that used an undocumented autorun parameter, for example `https://copilot.microsoft.com/?q=&autorun=1…`, could automatically fire off a prompt. That gave an attacker a way to pull data you’d already shared in that session. And if you’d connected other services, Varonis said the same method could also potentially expose email addresses, secrets and passwords in messages, Drive files, and calendar details.
The researchers say they found the issue by “meta-hacking” Copilot: asking over and over about its refusals, safety rules, and guardrails until it exposed the undocumented route. Varonis also said the chain involved persistent memory poisoning, where malicious instructions could keep shaping later behavior.
If you use Copilot with connected apps, you should install the fix, check which services are linked, remove anything you don’t need, and be careful with unexpected Copilot links. Microsoft said it found no evidence that the flaw was being exploited in the wild.
Varonis said it reported the issue in December 2025, Microsoft patched it on August 18, 2026, and the fix is now live in consumer-facing Copilot Personal.
Author: Sharilyn Deseo
{
"social": {
"email": "",
"facebook": "",
"twitter": "",
"linkedin": ""
},
"ja-JP": "",
"de-DE": "Sharilyn Deseo ist Content-Writerin und Rezensentin, die sich auf Software und digitale Tools spezialisiert hat. Sie bewertet Anwendungen kritisch und gibt Nutzern klare Einblicke, bevor sie eine Entscheidung treffen.",
"en-US": "Sharilyn Deseo is a content writer and reviewer specializing in software and digital tools. She critically evaluates applications and provides users with clear insights before they commit to a download or purchase.",
"es-ES": "Sharilyn Deseo es redactora y reseñadora especializada en software y herramientas digitales. Evalúa aplicaciones de forma crítica y ofrece a los usuarios información clara antes de tomar una decisión de descarga o compra.",
"fr-FR": "Sharilyn Deseo est rédactrice et critique spécialisée dans les logiciels et les outils numériques. Elle évalue de manière critique les applications et fournit aux utilisateurs des informations claires avant tout téléchargement ou achat.",
"it-IT": "Sharilyn Deseo è una content writer e recensore specializzata in software e strumenti digitali. Valuta criticamente le applicazioni e fornisce agli utenti informazioni chiare prima di procedere con download o acquisti.",
"nl-NL": "Sharilyn Deseo is een content writer en recensent gespecialiseerd in software en digitale tools. Ze beoordeelt applicaties kritisch en geeft gebruikers duidelijke inzichten voor ze een download- of aankoopbeslissing nemen.",
"pl-PL": "Sharilyn Deseo jest content writerką i recenzentką specjalizującą się w oprogramowaniu i narzędziach cyfrowych. Krytycznie ocenia aplikacje i dostarcza użytkownikom jasnych informacji przed podjęciem decyzji o pobraniu lub zakupie.",
"pt-BR": "Sharilyn Deseo é redatora e revisora especializada em software e ferramentas digitais. Ela avalia aplicativos de forma criteriosa e oferece aos usuários informações claras antes de baixar ou comprar."
}
View all posts by Sharilyn Deseo
