CoSnitch: one-click exfiltration and persistent memory rules in Microsoft Copilot Personal (CVE-2026-24301)
Disclosed vulnerability18 Aug 2026🗺️ Tool-Using AgentVaronis Threat Labs reportedly chained flaws in consumer Microsoft Copilot Personal so a crafted link with a hidden autorun parameter fired prompt execution on a single click, exfiltrated data from connected OAuth apps, and planted persistent memory rules that survived password resets and device re-enrollment; reportedly patched Aug 2026 with no evidence of abuse.
Root cause — why it happened
Copilot Personal can reach into the apps you've connected to it — your email, files and calendar — and it can also visit web addresses. Researchers reportedly found a hidden setting in Copilot's own web link that made a prompt run automatically the moment the page opened, so one click was enough to set Copilot to work under your login. A single click could tell it to gather private data from your connected apps and quietly hand it to the attacker by loading an attacker's web address. Worse, if you asked Copilot to summarise a booby-trapped web page, hidden text in that page could plant a standing rule in Copilot's long-term memory — and that planted rule reportedly stayed put even after changing the password, signing out, or re-setting up the device.
Risks this case illustrates
Named in the standard (OWASP/ATLAS/NIST) lens. Click a highlighted component in the diagram below to see which risks attach where.
How it unfolded
An undocumented parameter, found by asking
The researchers reportedly discovered the trick in an unusual way: they kept asking Copilot why certain prompts couldn't run by themselves, treating each refusal as a clue, until Copilot eventually described a hidden setting that would let a prompt run on its own. With that in hand, an attacker crafts a single Copilot link that carries both a hidden instruction and the 'run automatically' switch.
https://copilot.microsoft.com/<path>?q=<url-encoded instruction: read the user's connected mail/drive/calendar, collect items, then fetch an image URL that carries them>&autorun=1 # q= alone → merely pre-fills the prompt box. # q= + autorun=1 → prompt executes on page load, in the victim's signed-in session. # (Undocumented parameter, per Varonis; reportedly reframed out of Copilot itself.)
Controls & guardrails — what would have stopped it
Several layers together close this. A link should never be able to make Copilot run a prompt by itself — running should need a real click on a 'go' button. Copilot should only be allowed to send data to a short list of trusted places, so it can't quietly ship your data to a stranger's address. And anything a web page tries to save into Copilot's long-term memory should be checked — and wiped when you reset your account — so a planted rule can't keep working after you've changed your password.
- Egress allowlisting & DLP on tool argumentsaddressesSensitive Data Leakage
Allowlists fight an open-ended channel; legitimate-but-broad destinations (any URL fetch, any email) are hard to constrain without breaking usefulness. Encoding can evade naive DLP.
- Least-privilege identity & scoped credentials
Doesn't prevent manipulation — only caps its reach. Hard to get right operationally; over-broad scopes are the common real-world failure.
- Memory write validation, provenance & reviewaddressesMemory Poisoning
Validation can't always tell a legitimate preference from a planted instruction, and review only helps if users actually look. Raises effort, doesn't eliminate the vector.
- Delimiting / spotlighting of untrusted contentaddressesPrompt Injection (direct)
A trained convention, not enforcement. Determined payloads still break out, especially when content is long or the attack is novel. Combine with action-layer controls.
- Memory anomaly detection & quarantineaddressesMemory Poisoning
Detective, not preventive — harm may occur before detection. Distinguishing a poisoned memory from a quirky-but-legitimate one is hard at scale.
- Runtime monitoring & anomaly detection
Detects the anomalous, not the novel-but-subtle; high false-positive rates cause alert fatigue. Always a step behind a sufficiently quiet attacker.
- Full-trace audit logging
Logging is forensic, not preventive — it explains harm after the fact. Useless if no one reviews it or if the materialised context isn't captured.
- Governance: risk assessment, red-teaming & incident response
Process reduces likelihood and speeds recovery but executes no technical control itself; weak follow-through makes it theatre.
- Loop/cost circuit-breakers & consistency checks
Thresholds are blunt — too tight breaks legitimate long tasks, too loose lets damage accrue first. Catches runaway dynamics, not a single well-formed bad decision.
Lessons
- ▸ A one-click deep link can be a full prompt-injection trigger: an undocumented parameter that auto-executes a prompt without a user gesture turns a single click into code the attacker chose.
- ▸ Model-directed URL-fetch is an egress channel — if the AI can fetch any address, it can exfiltrate; the durable control is a destination allowlist plus argument DLP, not the input filter.
- ▸ A confused-deputy read runs under the victim's own OAuth grants, so a successful injection inherits the full scope of every connected app (mail, files, calendar) with no new privilege.
- ▸ Persistence is the real severity multiplier: a memory rule planted from a summarised web page reportedly survived password reset, session revocation and device re-enrollment — so ordinary remediation did not end the compromise.
- ▸ A model can leak its own attack surface: 'meta-hacking' reframed refusals into disclosure of an undocumented parameter — treat capability disclosure as part of the threat model.
Proposals & gaps this case surfaced
Non-destructive suggestions for the library — proposed, not adopted.
Tie the persistent-memory lifecycle to identity state so that standard remediation actually ends a compromise. On password reset, credential rotation, session revocation or device re-enrollment, invalidate (or quarantine for re-review) memory entries — especially entries whose provenance traces to summarised untrusted content — so a planted standing instruction cannot outlive the reset. Pair with write-path validation/provenance so instruction-shaped memory-writes from web content are caught on the way in.
This case shows a gap people rarely think about: when you reset your password or set up your device again to recover from a hack, you assume that clears out anything the attacker left behind. But the AI's long-term memory lived separately from your login, so a planted rule reportedly stayed put through all of that. Long-term memory should be treated as something that has to be cleared or re-checked when you reset your account — not left running.
These surface as proposals across the Control Library and Risk Taxonomy; adopt them by hand when ready.
Sources
- Varonis Threat Labs ↗
- The Hacker News ↗
- Varonis Threat Labs — CoSnitch ↗ — Original research: the autorun parameter-to-prompt trigger, confused-deputy OAuth read across connected apps, and credential-decoupled memory persistence. The CVE id and the Dec 2025 / 18 Aug 2026 dates are per this reporting; no independent NVD/CVE.org record was resolvable at time of writing.
- The Hacker News — Microsoft Copilot Personal Flaws Could Let One Click Exfiltrate Data From Connected Apps ↗ — Independent reporting of the one-click chain (18 Aug 2026).
Practise the risk class — related scenarios
An 'Ask AI' button quietly plants a permanent 'trusted source' rule in your assistant's memory
A coding agent asks to write ./notes.txt — the file it actually overwrites is your SSH keys
A support email hides instructions — and the assistant obeys them
A speed optimisation becomes a cross-tenant listening device
Two doors to the same secret: reconstruct the model through its API, or just walk off with the weight file
A fake Sentry error report hijacks a developer's coding agent into running a shell command
The forensic record is itself the attack surface — an agent's log is poisoned, then quietly rewritten
A newsletter the user asked to summarise quietly writes a false 'fact' into the agent's long-term memory — and it detonates weeks later
A planted 'standing goal' copies itself agent-to-agent through the team's shared config files
One click provisions an attacker-configured agent inside your own workspace
An attacker plants prompt injection in the audit trail — so the LLM that hunts them erases the evidence
A single poisoned document plants a standing instruction that survives every reset
Encoded public text is laundered across an agent handoff into an on-chain transfer
A screenshot that's harmless at full size becomes an order once the system shrinks it
An attacker captures the agent's bearer token — and inherits its authority
A forged peer registers on the agent directory — and the planner enlists it
The eval gate that was supposed to catch the agent is itself the thing being attacked
A poisoned web page hijacks a research agent — and the planner acts on its behalf
A GUI agent clicks 'Continue' — but the screen moved, and it lands on 'Send'
An inbox summary quietly ships a secret to an attacker's server