Microsoft Copilot Personal Flaws Could Let One Click Exfiltrate Data From Connected Apps

KUALA LUMPUR, 19 AUGUST 2026 —

Varonis Threat Labs said three vulnerabilities in Microsoft Copilot Personal allow a single click on a crafted link to silently exfiltrate emails, calendar entries, cloud files and chat history from connected apps.

The bugs, tracked as CoSnitch and assigned CVE-2026-24301, were fixed in the August 18, 2026 patch release after Varonis disclosed them in December 2025. Microsoft’s Security Update Guide lists the consumer assistant at copilot.microsoft.com but does not indicate the same behaviour affected Microsoft 365 Copilot.

In testing, the researchers recovered message bodies, email metadata, calendar titles and attendees, Google Drive file names, full conversation history and saved user instructions from the victim’s Copilot session, Varonis said. The stolen payloads travel as base64-encoded text inside summarization requests, making them hard to spot in outbound traffic filters.

The core issue centres on an undocumented URL parameter, autorun=1, that Copilot itself revealed during repeated prompts about running actions without user interaction. When the researchers built the URL with both autorun=1 and the q parameter, Copilot executed the prompt even if the tab was closed immediately after the page loaded, the firm said.

Varonis grouped the findings into three vulnerabilities. The first two enable one-click exfiltration of data from connected services; the third is a memory-poisoning path that lets an attacker inject instructions that survive password changes, session revocation and device re-enrollment until the user deletes them manually.

Microsoft’s connector documentation states users must authorise each service and that Copilot only accesses content the account already permits. Varonis countered that the exfiltration requests are indistinguishable from normal summarization fetches, adding that base64 encoding can help bypass pattern-matching controls.

The disclosure follows closely on Varonis’s June 26 report of RovoBlast, a one-click attack on Atlassian Rovo that abused a similar URL parameter. Atlassian issued a fix before public disclosure.

Varonis recommends auditing connected apps, treating Copilot as a privileged insider for access reviews, and exercising caution with links that open AI assistants. The report does not specify a client update users must install.

Related: Microsoft