Varonis Threat Labs has disclosed three connected flaws in Microsoft Copilot Personal — the consumer assistant at copilot.microsoft.com — collectively named CoSnitch and tracked as CVE-2026-24301.
Microsoft fixed them server-side on 18 August 2026. They were reported in December 2025.
The enterprise product, Microsoft 365 Copilot, is not affected.
How the researchers found the parameter
By asking the assistant.
Varonis kept putting prompts to Copilot that it would not run without user interaction, and kept asking it why — and the assistant eventually explained the conditions under which a prompt runs automatically, naming an undocumented autorun URL parameter. The researchers describe the product as having been played rather than breached, and that is a fair description: no memory corruption, no authentication bypass, just a system explaining its own guardrail in enough detail to route around it.
This is a category worth naming. A model that can describe its own controls is a model that can be interviewed about them.
The chain
Pair the undocumented autorun parameter with the ordinary q parameter that carries a query, and a crafted link becomes an instruction that executes on page load, inside the victim's already-authenticated session, with the same capability as something they typed themselves.
The only action required of the victim is opening the link. Varonis reports the prompt keeps running even if the tab is closed straight away.
What comes back
The injected prompt can reach whatever the victim has already connected. In testing, Varonis pulled:
| Source | What came out |
|---|---|
| Message bodies, subjects, sender and recipient metadata | |
| Calendar | Event titles, attendees, times, locations |
| Google Drive | File names and metadata summaries |
| Chat history | Full prior conversation content |
| Memory | Saved instructions and user-defined rules |
The data is encoded — often base64 — and pushed out through Copilot's own URL-fetching ability to a webhook the attacker controls.
Note what is not happening: no new permissions are granted and the user's own access is not expanded. The attacker is simply spending the access the victim already had. That is the recurring shape of these bugs, and it is the same one in Atlassian's Rovo and in the MCP split-instruction work — the assistant is a confused deputy with a valid badge.
The third flaw is the one that lasts
The first two end when the session does. The third does not.
A crafted web page, summarised by Copilot, can write the attacker's instructions into the victim's persistent memory. Varonis reports those entries survive a password change, a session revocation and a device re-enrolment, and stay active in later conversations until somebody deletes them by hand.
They also generate no process, no file, no network connection and no log line that a security tool would flag. The industry-standard response to account compromise — rotate the credential, kill the sessions, re-enrol the device — does not touch this. There is no artefact to find and no alert to tune.
Persistent instruction files are becoming their own category; Mitiga's PromptLogger work made the same point about instruction files that outlive the session that created them.
Microsoft's position, and the gap
Microsoft wrote about memory-poisoning in June 2026, describing sanitisation and prompt-injection checks applied when memories are written, plus adherence checks and audit logging in the enterprise product.
Those protections are described for Microsoft 365 Copilot. The consumer product is where Varonis found them insufficient, which is the uncomfortable pattern: the hardening lands first where the contracts are.
The 8-month gap between report and fix is the other number to sit with. Varonis has not said whether Microsoft removed memory entries injected before the patch — so a user poisoned in that window may still be carrying the instruction.
What to do
- Go and read your Copilot memory. This is the one action with a real payoff, because a server-side patch cannot un-write what was already written. Anything you did not put there, delete.
- Disconnect the connectors you are not using. Mail, calendar and drive integrations are the entire blast radius. What is not connected cannot be read.
- Treat an assistant as an identity, not a feature. It holds standing access to several systems at once and acts on instructions from whatever it reads. Varonis's framing — review it like a privileged insider — is the right one, and it is where the Five Eyes guidance on agentic AI landed too.
- Be suspicious of links that open an assistant. A URL to a chat product with a long query string is now a payload delivery format.
What is not established
- Exploitation in the wild. Varonis reports no evidence of it.
- Whether pre-patch memory injections were cleaned up. Not stated.
- Whether other assistants share the pattern. Nobody has published equivalent testing, and the underlying design — persistent memory written from summarised, untrusted web content — is not unique to Microsoft.
