Microsoft Patches One-Click Copilot Flaw That Could Expose User Data

Microsoft has patched a vulnerability in Copilot that researchers say could have allowed attackers to access and leak sensitive user data after a victim clicked a specially crafted link.

The flaw, dubbed CoSnitch by researchers at Varonis Threat Labs, affected Microsoft Copilot Personal and was tracked as CVE-2026-24301. Varonis disclosed the issue to Microsoft in December 2025, with fixes released on August 18, 2026.

Varonis said it has found no evidence that CoSnitch was exploited in real-world attacks, meaning the research represents a demonstrated security risk rather than a known active campaign.

Researchers said the attack could cause Copilot to automatically execute an attacker-controlled prompt when a victim opened a malicious Copilot link. Because Copilot can connect to services such as email, cloud storage and calendars, the injected prompt could potentially retrieve information the user had already authorized Copilot to access and send that data to an attacker-controlled server.

One click could start the attack

According to Varonis, the vulnerability involved an undocumented URL parameter that allowed a prompt embedded in a link to run automatically. Normally, opening a Copilot link containing a prepared question would still require the user to submit it. The additional parameter removed that step, allowing the command to execute as soon as the page loaded. Researchers demonstrated how this could be combined with Copilot’s connected services to retrieve information from sources such as Gmail, Google Drive, calendars and previous Copilot conversations.

Varonis also detailed a separate prompt-injection technique that could manipulate Copilot’s persistent memory after it processed a specially prepared webpage. Researchers repeatedly questioned Copilot about how automatic prompts worked, eventually leading the AI assistant to reveal details about the undocumented parameter itself, referring to the technique as “meta-hacking.”

The discovery nevertheless highlights a growing security concern surrounding AI assistants. As AI assistant tools gain access to email, files, calendars and other services, a vulnerability affecting the assistant can potentially provide a path to information spread across several connected accounts.

The most important point is that the flaw has been addressed, but serves as a reminder to limit AI assistants to the accounts and services they actually need access to with proper permissions.