A Copilot security vulnerability discovered by Varonis Threat Labs has turned Microsoft’s AI assistant into a potential data-theft tool — and all it takes is one click on a crafted link. Dubbed CoSnitch and tracked as CVE-2026-24301, the flaw sits inside Copilot Personal’s connected app integration and allows a remote attacker to silently pull emails, calendar entries, and files from your linked third-party services without you ever knowing.
What Is the CoSnitch Copilot Exploit?
The CoSnitch Copilot exploit is a chain of three chained vulnerabilities that Varonis Threat Labs published on 18 August 2026. At its core, CVE-2026-24301 abuses a hidden autorun URL parameter inside Microsoft Copilot Personal. When a signed-in user clicks a specially crafted Copilot link, the parameter silently triggers an attacker-supplied prompt in the background — no confirmation dialog, no warning, no second click required.
Because Copilot Personal has permission to talk to connected apps — think Google Calendar, Slack, Dropbox, LinkedIn, and more — that auto-run prompt can instruct Copilot to read data from those services and encode the results into an outbound URL, effectively handing the attacker a clean copy of whatever it retrieves. The entire exfiltration chain completes before the page even finishes loading.
A separate but related Microsoft 365 Copilot Enterprise flaw, called SearchLeak, similarly allowed one-click theft of MFA codes, email threads, meeting notes, and indexed organisational files — with a CVSS score of 9.3. These are not theoretical edge cases; they are working, proof-of-concept attack chains verified by independent security researchers.
How the Copilot Data Leak Actually Works
Understanding the Copilot data leak mechanism helps you appreciate why it is so dangerous. Here is the attack chain in plain terms:
- Attacker crafts a link. A malicious actor creates a Copilot Personal URL with a hidden
autorunquery parameter containing an injected prompt. - Victim clicks the link. The link looks harmless — it resolves to copilot.microsoft.com, a domain most users trust implicitly.
- Prompt executes silently. Copilot, already authenticated in the browser session, reads the embedded instruction and processes it as if the user typed it themselves.
- Connected apps are queried. The injected prompt tells Copilot to pull specific data from whichever third-party apps are connected — emails, calendar events, contacts, documents.
- Data is exfiltrated via URL. Results are base64-encoded and appended to a redirect URL that sends them to an attacker-controlled server. The tab closes; the user sees nothing.
What makes the Microsoft Copilot flaw particularly alarming is that Copilot’s own safety guardrails — designed to block direct data leaks — only apply to the initial user request. They were never built to scrutinise injected prompts arriving via URL parameters. Attackers essentially bypassed the front door by walking through a side entrance the security team hadn’t locked yet.
What Data Was at Risk from the Copilot Security Vulnerability?
The scope of the Copilot security vulnerability depends on which apps a victim has connected to their Copilot account. In the worst-case scenario — a power user with many integrations — an attacker could silently retrieve:
- Email content, including sensitive threads and attachments
- Calendar appointments with attendee details and location data
- Files stored in connected cloud drives (OneDrive, Dropbox, Google Drive)
- Contacts and messaging history from connected chat platforms
- MFA codes and authentication tokens (in the M365 Enterprise variant)
- Internal organisational files indexed by Microsoft 365 Copilot Enterprise Search
For enterprise users, the SearchLeak variant of this Copilot exploit could expose data that employees have access to but rarely think about — shared SharePoint libraries, HR documents, finance spreadsheets — all reachable via Copilot’s Enterprise Search index with a single weaponised link sent to one employee.
Microsoft’s Response and the Patch
Microsoft patched both the CoSnitch (CVE-2026-24301) and SearchLeak vulnerabilities after Varonis responsibly disclosed the findings through the coordinated vulnerability disclosure process. The fix is server-side, meaning end users are not required to install a Windows update or patch any local software — Microsoft deployed the remediation directly to the Copilot service infrastructure.
That is both good news and a sobering reminder: because Copilot runs in the cloud, users had zero visibility into whether they had been targeted before the patch landed. Unlike a desktop application where you can check a version number, cloud-hosted AI services update silently — and so do the vulnerabilities that exploit them.
If you are concerned about whether your organisation may have been exposed, it is worth auditing your Microsoft 365 sign-in logs for unusual Copilot activity during the disclosure window. Microsoft’s Unified Audit Log in the Microsoft Purview compliance portal can surface Copilot query activity across your tenant.
This incident follows a broader pattern of AI-specific attack vectors emerging as companies rush to integrate large language models into productivity tools. Earlier in 2025, the EchoLeak flaw (CVE-2025-32711, CVSS 9.3) demonstrated that Microsoft 365 Copilot could be exploited via zero-click prompt injection — no user interaction at all. CoSnitch required one click, but the direction of travel is clear: AI assistants are becoming high-value targets because they sit at the centre of our most sensitive data.
Is This a Copilot Exploit You Need to Act On Right Now?
The short answer: the specific CVE-2026-24301 Copilot exploit is patched. You do not need to take emergency action for this particular flaw. However, the underlying risk — that your AI assistant’s connected integrations represent a large and under-scrutinised attack surface — remains very real. Every new app you connect to Copilot expands the blast radius if a similar vulnerability emerges tomorrow.
Here is a practical checklist to harden your Copilot setup right now:
- Audit your connected apps. Go to your Copilot settings and review every third-party integration. Disconnect anything you no longer actively use.
- Apply least-privilege thinking. If a connected app only needs read access, do not grant write access. Reduce Copilot’s reach to the minimum it needs.
- Be sceptical of shared Copilot links. Even links that resolve to official Microsoft domains can carry injected parameters. If you did not expect a Copilot link, do not click it without verifying the sender.
- Enable Microsoft Purview audit logging. This gives your security team visibility into what Copilot is doing on your tenant, so anomalies surface faster.
- Keep an eye on Microsoft’s Security Response Center (MSRC) advisories. New AI-specific CVEs are appearing regularly — staying subscribed means you hear about patches before attackers weaponise the window.
- Use conditional access policies. Restrict Copilot access to compliant, managed devices where possible, reducing the risk that a compromised personal browser session becomes your organisation’s weakest link.
The Bigger Picture: AI Assistants as a New Attack Surface
The CoSnitch Copilot data leak is not an isolated incident. It sits alongside a growing catalogue of AI-specific vulnerabilities that exploit the very features that make these tools useful: deep integration, persistent authentication, and broad data access.
What is new in 2025 and 2026 is the one-click threshold. Attackers no longer need to social-engineer a victim into downloading malware or entering credentials into a phishing page. A single click on a plausible-looking link is now sufficient to hand over everything Copilot can reach — and Copilot can reach a lot.
Organisations that have deployed Microsoft 365 Copilot at scale should treat it with the same security rigour they apply to any privileged service account. That means access reviews, audit logging, and integration minimisation — not just trusting that Microsoft’s guardrails will hold.
For context on how Microsoft’s AI infrastructure investments and cost trade-offs influence product security decisions, see our earlier look at AI model infrastructure costs and how they shape Microsoft Copilot. And if you want a broader picture of how Microsoft security flaws are affecting enterprise users right now, our breakdown of the Windows Defender RoguePlanet zero-day and its workarounds is essential reading.
For the full technical breakdown of CoSnitch directly from the researchers who found it, the Varonis Threat Labs CoSnitch report is the authoritative source. Varonis is a data security company with a strong track record of responsible disclosure, and their technical write-up includes the full proof-of-concept chain.
How to Stay Safe as Copilot Grows More Powerful
Microsoft Copilot is adding capabilities faster than most security teams can assess them. Every new data connector, every new enterprise integration, every new agentic feature is a potential vector for a future Microsoft Copilot flaw. The answer is not to avoid AI tools — they genuinely improve productivity — but to adopt a security-first posture around how you deploy them.
Treat AI assistants as privileged insiders: useful, powerful, but in need of the same access controls and audit trails you would apply to any other account with broad read permissions across your organisation’s data estate. The CoSnitch vulnerability is patched, but the next one is already being researched — by defenders and attackers alike.
FAQ
Is the Copilot security vulnerability still active?
No. Microsoft has deployed a server-side patch for CVE-2026-24301 (CoSnitch) and the related SearchLeak vulnerabilities. Because the fix is applied at the service level, no user action is required. However, similar vulnerabilities may emerge as Copilot continues to expand its feature set, so ongoing vigilance is important.
Which Copilot products were affected by the data leak?
Two distinct products were affected. Copilot Personal (the consumer version at copilot.microsoft.com) was vulnerable to CoSnitch (CVE-2026-24301), which targeted connected third-party apps. Microsoft 365 Copilot Enterprise was affected by the SearchLeak variant, which could expose emails, MFA codes, meeting details, and indexed organisational files. Both have been patched.
How do I disconnect apps from Microsoft Copilot Personal?
Sign in to copilot.microsoft.com, click your profile icon in the top-right corner, then go to Settings. Under the Plugins or Connected Apps section, you will see all active integrations. Click the toggle or Remove button next to any app you want to disconnect. Removing an integration revokes Copilot’s access to that service immediately.
Could I have been targeted without knowing?
Yes — that is what makes this Copilot exploit particularly concerning. The exfiltration happens silently in the background after a link click, with no visible sign to the user. If you regularly click Copilot-related links shared in emails or messaging apps, it is worth reviewing your Microsoft Purview Unified Audit Log for any unusual Copilot query activity during July–August 2026.
Does this affect Copilot built into Windows 11?
The Windows 11 sidebar Copilot experience is a different surface to Copilot Personal and Microsoft 365 Copilot Enterprise. The specific CVEs disclosed relate to the web-based Copilot Personal service and M365 Enterprise Search integration. That said, as Copilot’s agentic capabilities expand into Windows itself, the principle of reviewing connected integrations and applying least-privilege access applies equally to the Windows-integrated version.
What is prompt injection and how does it relate to this flaw?
Prompt injection is an attack technique where malicious instructions are embedded in content that an AI model processes — tricking it into executing attacker commands instead of following its intended guidelines. In CoSnitch, the injected prompt arrived via a URL parameter, auto-running when the link was clicked. It is the AI equivalent of an SQL injection attack, exploiting the model’s instruction-following behaviour rather than a traditional code vulnerability.
