A single click on a crafted link handed attackers full read access to your Gmail, Google Drive, and Outlook — silently, through Microsoft Copilot, with no confirmation prompt. Varonis Threat Labs disclosed the three-vulnerability chain on August 18 as CVE-2026-24301, nicknamed CoSnitch. Microsoft patched it server-side the same day. No update required on your end. But if you clicked a suspicious Copilot link before August 18, your assistant’s memory may still be poisoned.
How the Attack Worked #
CoSnitch is not one bug. It’s three weaknesses chained to create a nearly invisible attack path.
The first link: an undocumented autorun=1
URL parameter, combined with Copilot’s standard ?q=
query string, caused any attacker-supplied prompt to execute automatically when the page loaded. A victim only needed to click a link — no paste, no confirmation, no tool approval. The attacker’s crafted URL looked like copilot.microsoft.com/?q=[malicious prompt]&autorun=1
.
The second link: Copilot’s web summarization feature. When asked to summarize a page, Copilot retrieved the full content — including HTML comments and hidden metadata. Attackers embedded prompt injection payloads in those hidden elements. Copilot processed them as instructions.
The third link, and the most durable: persistent memory poisoning. Once the injected prompt ran, it wrote malicious rules to Copilot’s long-term memory — rules that survived password changes, session revocations, and device re-enrollment. Clean session, same backdoor.
What Was Exposed #
With access to connected OAuth apps, the attack could pull:
- Gmail and Outlook email content, including sender, recipient, and body
- Google Calendar meeting details
- Google Drive file metadata
- Copilot chat history
- Previously saved memory entries and custom instructions
The exfiltrated data was base64-encoded and sent as routine web requests — indistinguishable from normal Copilot browsing activity, invisible to standard DLP rules.
Copilot Explained the Attack Itself #
The most unsettling part of this disclosure is how Varonis found it. They did not reverse-engineer Copilot’s backend or intercept network traffic in a lab. They asked Copilot how to hack Copilot.
Researchers repeatedly prompted the assistant with variations of “why can’t prompts auto-execute on page load?” and “what would technically enable that?” Copilot, trained on Microsoft’s own developer documentation, described the URL parameter structure that made it possible. The Register’s headline put it bluntly: “Copilot tricked into telling researchers how to hack itself.”
Varonis calls this meta-hacking — using an AI’s own training data to surface its attack surface. It worked. That should make every AI security team uncomfortable.
This Is Not a One-Off #
August 2026 alone delivered three separate Copilot-family vulnerabilities. CVE-2026-59118 is an elevation of privilege in Copilot Cowork with a CVSS score of 9.3. CVE-2026-70335 is an OS command injection in GitHub Copilot and VS Code, patched in August Patch Tuesday, CVSS 7.8. And in 2025, CVE-2025-53773 was a wormable RCE in GitHub Copilot via prompt injection.
The pattern is clear: any AI assistant that can browse the web, read documents, or access connected accounts has a prompt injection attack surface. Every new capability — summarization, memory, OAuth connections — expands that surface. Security tooling has not kept pace. Standard WAFs, DLP systems, and SIEM rules do not catch base64-encoded data leaving through an AI session.
What to Do Now #
Microsoft’s patch is server-side — you need no action if you haven’t been exposed. But two things are worth doing regardless:
Audit your Copilot memory. Navigate to copilot.microsoft.com, open Settings, and review the Memory section. Delete any entries you did not create or that look unfamiliar. This is the only way to clear a pre-patch memory poisoning payload.
Audit connected apps. Review which OAuth connections Copilot has to Gmail, Drive, Calendar, and Outlook. Remove any you do not actively use. The attack only works if the connected apps are present — reducing that surface reduces future exposure from similar vulnerabilities.
The broader lesson is that a URL with autorun=1
should never have existed in an assistant with OAuth access to your email. “Secure by default” for AI assistants means no auto-execution of externally-supplied prompts, full stop. That this was found by asking the AI itself is the most damning part of the story.