Microsoft patches Copilot Personal one-click data exfiltration flaws
Microsoft patched three vulnerabilities in Copilot Personal on August 18, 2026, after Varonis Threat Labs reported that a crafted link could trigger a prompt in a signed-in user’s session and extract data from connected applications. The findings, collectively called CoSnitch, are tracked as CVE-2026-24301 in Microsoft’s Security Update Guide.
The research applies to the consumer assistant hosted at copilot.microsoft.com. Varonis did not say that the same automatic-execution behaviour affected Microsoft 365 Copilot, and said it found no evidence that the flaws had been exploited in the wild.
A link-based prompt execution path
Varonis said the one-click chain combined the existing q URL parameter with an undocumented autorun=1 parameter. On its own, q pre-fills Copilot’s input box. Used together, the parameters caused an attacker-supplied prompt to execute when the page loaded, without a user gesture.
The researchers said they discovered the parameter through repeated questions to Copilot about why a prompt could not execute without interaction. Copilot eventually described autorun=1, the session conditions in which it worked, and protections that were meant to have disabled it. Varonis reported the issue to Microsoft in December 2025.
Once execution started, the prompt could continue even if the user closed the Copilot tab immediately after it loaded. That makes the issue related to the risk demonstrated in Microsoft 365 Copilot one-click data leak while differing in the product scope and the URL mechanism described by Varonis.
Connected services and persistent memory
The injected prompt could query services that the user had already authorized, encode retrieved material and use Copilot’s built-in URL-fetch function to send it to an attacker-controlled webhook. Varonis said this did not grant new provider permissions or extend the user’s existing access.
In testing, the firm said it retrieved mail message bodies, subjects and participant metadata; calendar titles, attendees, times and locations; Google Drive file names and metadata summaries; chat history; and saved memory instructions and user rules. Microsoft’s connector documentation states that connected services use the account’s existing permissions and do not expand access beyond content the user can view.
Varonis also described a separate web-summarization route that could write attacker instructions into Copilot’s memory store. Those instructions could influence later conversations until removed in Copilot’s memory settings. The disclosure does not state whether Microsoft’s remediation removed entries created before the fix.
What organizations should review
Varonis advised users to review Copilot-connected applications and disconnect services that are not actively needed. It also recommended treating the assistant as a privileged insider for access reviews and anomaly detection, and using caution with links that open AI assistants.
For businesses, the practical implication is to limit Copilot connections to necessary services, review memory settings and make AI-assistant links part of normal access and phishing-risk controls.