Loading story…
Varonis Threat Labs disclosed CoSnitch, a chained attack against Microsoft Copilot Personal that could trigger prompt execution from a malicious link, exfiltrate data from connected services, and poison the assistant’s persistent memory. Researchers said the chain combined three issues: an undocumented autorun=1 URL parameter that executed prompts on page load in an authenticated session, abuse of Copilot’s URL-fetching and connected OAuth data sources to pull information from services such as Gmail, Google Drive, Google Calendar, and Copilot chat history, and indirect prompt injection through web summarization that could write attacker instructions into memory.
The researchers said they uncovered parts of the attack path by repeatedly questioning Copilot about failed prompt auto-execution attempts, eliciting details about its own security controls and hidden parameters without reverse engineering. Varonis reported the issue to Microsoft in December 2025, and Microsoft shipped patches on August 18, 2026; one report said CVE assignment was also being prepared. Varonis said it found no evidence of exploitation in the wild, but warned the flaw reflects a broader weakness in AI assistants that can treat untrusted content as executable instructions while operating with the user’s authorized access.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
Microsoft shipped patches for the CoSnitch issues on August 18, 2026, according to Varonis. Varonis said it had seen no evidence that the attack chain was exploited in the wild.
After Varonis reported CoSnitch, Microsoft implemented initial protective measures in February 2026 before releasing full fixes later in August. This represents an intermediate remediation step for the Copilot Personal vulnerability chain.
Varonis Threat Labs disclosed the CoSnitch vulnerability chain to Microsoft in December 2025. The issue involved prompt auto-execution, data exfiltration through connected services, and persistent memory poisoning in Microsoft Copilot Personal.
Varonis Threat Labs publicly disclosed CoSnitch, a chained attack against Microsoft Copilot Personal that used an undocumented autorun URL parameter, connected OAuth data sources, and web summarization-based prompt injection. The researchers said they uncovered the chain through a technique they called meta-hacking, in which Copilot revealed architectural details through iterative questioning.
Microsoft assigned CVE-2026-24301 to the CoSnitch issue, classifying it as an information disclosure vulnerability affecting Copilot Personal and rating it 8.8 under CVSS 3.1. The company said enterprise customers were unaffected and no customer action was required after the fix.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
11 references tracked. Mallory keeps watching after this page renders.
heise.de
Open sourcexakep.ru
Open sourcecysecurity.news
Open sourcecyberupdates365.com
Open sourcethehackernews.com
Open sourcevaronis.com
Open sourcetheregister.com
Open sourcemicrosoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers disclosed **CVE-2026-32193**, a Microsoft Copilot hijack that abused an undocumented URL parameter, `?autorun=1`, to bypass the normal user-approval step and automatically run attacker-supplied prompts. By pairing that parameter with crafted input in the `q` field, an attacker could make Copilot operate within a victim’s authenticated session, search connected enterprise data including inbox contents, and send sensitive results to an attacker-controlled server. The attack could be delivered through phishing links, chat messages, webpages, or QR codes, and researchers reported it could continue even if the victim closed the Copilot tab immediately after opening it. Separate reporting tied the issue to a broader attack chain described as moving from an **AKS node root vulnerability** to a Copilot compromise, underscoring how cloud and AI weaknesses can be chained together. Researchers also described a second prompt-injection method that poisoned Copilot’s persistent memory using hidden webpage metadata, allowing later manipulation of Copilot responses and actions. The disclosures highlight risks from undocumented AI features, prompt injection, and trusted-session abuse in enterprise copilots connected to corporate data.
Aug 20, 2026
Researchers reported that vulnerabilities in Microsoft 365 Copilot and Consumer Copilot allowed attackers to turn prompt injection into data exfiltration, memory poisoning, and persistent compromise. Microsoft assigned `CVE-2026-24299` to the main issue set and rolled out fixes across late 2025 and early 2026, while a related Microsoft Excel flaw, `CVE-2026-26144`, showed how a conventional application bug could be chained with Copilot Agent mode to silently extract spreadsheet data. In the Copilot attacks, malicious content abused HTML preview rendering to leak sensitive information through external requests, first with CSS background images and later with `@font-face`, and researchers said users could be coerced into triggering the preview during normal interaction, creating a near zero-click exfiltration path. The research also showed that Copilot’s memory features could be poisoned to add or delete stored facts and implant persistent instructions that altered future sessions, enabling a backdoor dubbed **SpAIware** that continued leaking secrets over time. Similar issues were described in consumer Copilot, including durable-memory manipulation and browser-navigation exfiltration through Edge-integrated tooling. The findings underscore a broader security shift: AI assistants can collapse trust boundaries inside host applications, raising the impact of older flaws and forcing defenders to reassess assistant permissions, restrict outbound network access from AI-enabled apps, and separately monitor AI-initiated network activity.
Jun 29, 2026
Security researchers disclosed attacks against Microsoft Copilot that use prompt injection and chained requests to extract sensitive data with minimal user interaction. Varonis Threat Labs described a **single-click** technique called **Reprompt** against **Microsoft Copilot Personal** that abuses legitimate Copilot links with a prefilled `q` parameter, then uses a **double-request** and **chain-request** flow to hide exfiltration instructions on an attacker-controlled server. The report said the attack could continue pulling data from an active session even after the Copilot tab was closed, while evading many client-side monitoring tools; Microsoft said the issue had been patched, and Varonis reported that **Microsoft 365 Copilot enterprise customers were not affected**. A separate report from **Rubrik Zero Labs** said it had **broken the Microsoft 365 Copilot sandbox** in research published under the title *ChatMate*, indicating continued scrutiny of Copilot’s isolation and data-protection boundaries across Microsoft’s AI offerings. Together, the disclosures highlight how trusted Copilot workflows, prefilled prompts, and multi-step prompt handling can be abused to bypass intended safeguards and expose user data, reinforcing the need to treat AI prompt inputs and follow-on actions as untrusted.
Aug 12, 2026