Microsoft Copilot Personal Flaws Could Let One Click Exfiltrate Data From Connected Apps

The cybersecurity community has been made aware of three vulnerabilities in Microsoft Copilot Personal that could potentially allow an attacker to silently pull data from connected apps and other information available to the victim's Copilot session.

The vulnerabilities, collectively named CoSnitch, were discovered by Varonis Threat Labs and could be exploited by a single click on a crafted link. The flaws turn in part on an undocumented URL parameter that the assistant itself surfaced during testing.

According to Varonis, the researchers found no evidence that CoSnitch was exploited in the wild. They reached the parameter by repeatedly asking Copilot why a prompt could not be made to run without user interaction, an approach the firm calls meta-hacking.

The attack URL pairs autorun=1 with the existing q parameter. Varonis stated that q alone only pre-fills the input box, and both parameters must be present for the prompt to fire without a user gesture.

Varonis grouped the findings into three vulnerabilities. The first two form the one-click exfiltration path, while the third is a separate memory-poisoning path triggered through web summarization.

### Vulnerabilities in Microsoft Copilot Personal

| Vulnerability | Description | | --- | --- | | Automatic prompt execution | The two parameters together cause an attacker-supplied prompt to run on page load inside the victim's authenticated session, with the same capabilities as an instruction the user typed. | | Exfiltration through connected services | The injected prompt can query services the user has already authorized, encode retrieved data, and use Copilot's built-in URL fetch to send it to an attacker-controlled webhook. | | Persistent memory writes from summarized pages | A crafted web page, when summarized by Copilot, can cause the assistant to write attacker instructions into the user's memory store, where they can shape later sessions. |

In testing, the researchers said Copilot returned message bodies, subject lines, and sender and recipient metadata from connected mail accounts, calendar titles, attendees, times, and locations, file names and metadata summaries from Google Drive, full prior conversation content from chat history, and the saved instructions and user-defined rules held in the memory store.

Microsoft's connector documentation says users must authorize services before Copilot can access them and that connected services process requests using the user's existing permissions. Microsoft says Copilot does not expand that access and only works with content the account already has permission to view.

Varonis said the exfiltration request is indistinguishable at the network layer from the fetches Copilot performs when it summarizes an ordinary web page, and that base64 encoding can help avoid filters scanning outbound requests for sensitive patterns such as credentials.

On the separate memory path, the firm said an injected instruction survives password changes, session revocation, and device re-enrollment, and stays active in later conversations until the user deletes it from Copilot's memory settings.

Varonis also said the memory write produces no process, file, network connection, or log entry that security tooling would flag, with the change visible in Copilot's memory interface.

The web summarization path is not the first time Copilot memory has been reported to Microsoft. Researcher Håkon Måløy documented an attacker-controlled page that persisted an unintended memory when a victim used a Microsoft 365 Copilot summarization flow, publishing on June 22, 2026 after a 90-day coordination period and recording the Microsoft-side status as "mitigated globally."

Johann Rehberger separately reported memory writes and deletions through indirect prompt injection in Microsoft 365 Copilot, as well as memory modification in the consumer assistant, in research associated with CVE-2026-24299.

Microsoft set out its own position on the same class of attack in a June 22 security blog post that credited MSRC cases from Rehberger, Måløy, and Gal Zror. Scoped to Microsoft 365 rather than the consumer product, the company said memories pass through sanitization and prompt-injection checks on write, that M365 Copilot is designed to run Task Adherence checks on every explicit memory write, and that memory updates are recorded to organizational audit logs and surfaced to analysts through a MemoryUpdated field in Defender Advanced Hunting and Sentinel.

Varonis advised reviewing which apps are connected to Copilot and disconnecting those not actively needed, treating the assistant as a privileged insider for access review and anomaly detection, and exercising caution with links that open AI assistants.

The company did not identify a client update that users need to install. Varonis said injected memories persist until explicitly removed; its disclosure does not state whether Microsoft's remediation retroactively removed memory entries created before the fix.

The disclosure comes less than two weeks after the same team detailed RovoBlast, a one-click attack on Atlassian's Rovo assistant that abused the rovoChatPrompt URL parameter to seed attacker-controlled instructions into a signed-in user's session. Varonis said Atlassian fixed the issue before its public disclosure.