SERVANTSTACK // INCIDENT INTELLIGENCEFORENSIC IMAGE // VERIFIED FRAMEMicrosoft Copilot
Researchers Get the Assistant to Reveal Its Own Hidden Autorun Path, Then Demonstrate One-Click Data Theft and Persistent Memory Poisoning
On August 18, 2026, Varonis Threat Labs disclosed CoSnitch, an 8.8-rated Microsoft Copilot Personal vulnerability chain that could automatically execute a prompt from one crafted link, read data from connected services, exfiltrate it through Copilot's own URL-fetch behavior, and poison persistent memory. Microsoft patched CVE-2026-24301, and neither Varonis nor Microsoft reported known exploitation in the wild.
- 01TRIGGERVaronis disclosed CoSnitch after reporting the issue to Microsoft in December 2025 and coordinating through an…
- 02MACHINE ACTIONAutonomous actor
- 03MISSING GATERisk-based SME approval before execution
- 04IMPACTData security
The short version
On August 18, 2026, Varonis Threat Labs disclosed CoSnitch, an 8.8-rated Microsoft Copilot Personal vulnerability chain that could automatically execute a prompt from one crafted link, read data from connected services, exfiltrate it through Copilot's own URL-fetch behavior, and poison persistent memory. Microsoft patched CVE-2026-24301, and neither Varonis nor Microsoft reported known exploitation in the wild.
Case telemetry
- INCIDENT
- SS-IR-106
- DATE
- August 18, 2026
- SYSTEM
- Microsoft Copilot
- LOCATION / SCOPE
- Microsoft Copilot Personal; global consumer service
- EVIDENCE
- Documented
- AI ROLE
- Autonomous actor
- HARM
- Data security
- SOURCES
- 2 cited records
The event
Varonis disclosed CoSnitch after reporting the issue to Microsoft in December 2025 and coordinating through an eight-month remediation period. Researchers first asked Copilot how automatic prompt execution could work; as they reframed each refusal, the assistant progressively described its URL behavior and eventually exposed an undocumented autorun parameter. A crafted Copilot URL could then execute the embedded prompt as soon as the page loaded, without a confirmation step after the victim opened the link. The prompt could query services already connected to that Copilot Personal session - including Gmail, Google Drive, Google Calendar, OneDrive, Copilot memory, and chat history - encode returned data into a URL, and make Copilot fetch an attacker-controlled destination. The trusted assistant became both the data reader and the outbound channel, making the traffic resemble its normal link-handling behavior. A separate indirect-prompt-injection path could place attacker instructions into Copilot's persistent memory when a user summarized a poisoned webpage; Varonis reported that the injected memory survived password changes, session revocation, and device re-enrollment until manually removed. Microsoft assigned CVE-2026-24301, rated it 8.8 under CVSS 3.1, and shipped server-side protections on August 18.
What the machine did
Copilot did not develop malicious intent or independently select a victim. The causal AI role was privileged execution: the assistant treated attacker-supplied text as authenticated user instruction, invoked the victim's existing connectors, and used its own fetch capability to move the results outside the trusted session. Its conversational behavior also helped researchers discover the undocumented trigger by revealing architectural details while explaining why the proposed attack should not work. The incident is a responsibly disclosed vulnerability demonstration, not a confirmed customer breach, and the affected product was Copilot Personal rather than Microsoft 365 Copilot Enterprise.
Where the failure landed
Microsoft patched the vulnerability on August 18, and Varonis reported no evidence of exploitation outside its research. The demonstrated blast radius nevertheless included any personal email, file, calendar, chat, or memory source a user had already connected to Copilot Personal, plus durable manipulation of future assistant behavior through poisoned memory. CoSnitch was Varonis's third Copilot disclosure in 2026 after Reprompt and SearchLeak, reinforcing a recurring trust-boundary failure around prompt provenance, connector authority, and covert egress.
Documented
Supported by Varonis's technical disclosure, Microsoft's CVE assignment and patch confirmation, and independent security reporting. The evidence establishes a researcher-demonstrated vulnerability in Copilot Personal, not exploitation in the wild or a known customer data breach.
SOURCE RECORD UPDATED 2026-08-18
2 cited records
- 01
- 02
Risk-based SME approval before execution
The failure pattern in this case: High-stakes output had no accountable checkpoint.
The moment the path could change
The appropriate subject-matter expert reviews the evidence, exceptions, and affected people before the output becomes action.
Autonomy is a design choice.
See the operating model that keeps AI useful while preserving human authority at consequential moments.
Compare AgenticAI and AugmentedAI →