**AI Security Alert: Critical Vulnerabilities Found in Microsoft Copilot Personal**
A recent report from Varonis Threat Labs has uncovered a significant security risk affecting users of Microsoft’s AI assistant. The vulnerabilities, collectively named **CoSnitch**, highlight how malicious actors could potentially trick the AI into performing unauthorized actions.
**The Discovery of CoSnitch**
Security researchers identified three distinct vulnerabilities within Microsoft Copilot Personal. The most critical of these allows for a “one-click” data exfiltration attack. This means that simply clicking on a specially crafted link could allow a malicious actor to silently steal data from any applications connected to the user’s Copilot session.
The discovery was made possible by an undocumented URL parameter that the Copilot assistant itself revealed during testing. Dubbed `autorun=1`, this parameter, when combined with another standard parameter (`q`), can force the AI to execute a malicious script automatically the moment a webpage loads. According to the researchers, this happens even if the user immediately closes the browser tab.
**How the Attack Works**
The attack does not break into the AI itself but rather “plays” it by abusing its existing functionality. The attack chain involves two main components:
1. **Automatic Prompt Execution:** The `autorun=1` and `q` parameters work together to execute a hacker’s instructions with the same permissions as a user-typed command.
2. **Exfiltration through Connected Services:** Once executed, the malicious prompt can command Copilot to query services the user has already authorized, such as email, cloud storage (like Google Drive), or calendars. The AI can gather file names, email metadata, calendar appointments, and even full conversation histories. This data is then encoded and sent to a server controlled by the attacker.
A particularly dangerous secondary vulnerability involves Copilot’s memory feature. A separate attack vector can inject instructions into a user’s persistent memory store via web summarization. This means harmful instructions could remain active in the AI’s memory, shaping future interactions until the user manually finds and deletes them.
**Scope and Impact**
It is important to note that the research specifically focuses on **Copilot Personal**, the consumer version hosted at `copilot.microsoft.com`. The report does not confirm whether the same vulnerabilities affected the enterprise version, Microsoft 365 Copilot.
Furthermore, the researchers found no evidence that CoSnitch was ever used in real-world attacks.
**Microsoft’s Response and Fixes**
Varonis Labs responsibly disclosed the vulnerabilities to Microsoft in December 2025. Microsoft released patches to address these issues on **August 18, 2026**. The company has designated these flaws as **CVE-2026-24301**.
Microsoft has stated that its memory sanitization and prompt-injection checks are designed to handle these threats. However, the research underscores the unique security challenges posed by AI assistants, which often require broad access to user data and services to function effectively.
***
### Frequently Asked Questions (FAQ)
**Q1: What is “CoSnitch”?**
A: CoSnitch is the name given by Varonis Threat Labs to a set of three vulnerabilities discovered in Microsoft Copilot Personal. These flaws could allow an attacker to execute malicious commands and steal data via a single crafted link.
**Q2: Is my data safe if I use Microsoft 365 Copilot?**
A: The reported vulnerabilities specifically targeted Copilot Personal. While the research did not explicitly confirm an impact on Microsoft 365 Copilot, security researchers have documented similar memory-injection vulnerabilities in the enterprise product. Users of any AI assistant should remain cautious.
**Q3: What should I do to protect myself?**
A: The most immediate step recommended by Varonis is to review the list of applications and services connected to your Copilot account and disconnect any that are no longer needed. This limits the potential damage an attacker could inflict. Additionally, users should be cautious about clicking on unknown or suspicious links, especially those that prompt interaction with an AI assistant.
**Q4: Did Microsoft fix the problem?**
A: Yes. Microsoft issued security patches on August 18, 2026, to address the vulnerabilities. The specific tracking ID for the fix is CVE-2026-24301.
**Q5: Can the AI’s memory be dangerous?**
A: Yes. One of the attack methods involves writing instructions directly into Copilot’s persistent memory. This is dangerous because these injected commands can influence future conversations and sessions, even after the initial malicious link is closed. Users must manually review and clear their AI memory settings to remove any unwanted instructions.
***
### Conclusion
The CoSnitch vulnerabilities reveal a new frontier in cybersecurity threats: the prompt injection of AI assistants. While Microsoft has released fixes for these specific issues, the report serves as a critical reminder that as AI tools become more integrated into our workflows and data, they must be treated with the same security scrutiny as any other privileged application. Users must manage connected apps cautiously, and developers must continue to build in layers of defense to protect against these increasingly sophisticated “AI-native” attacks.
