{"slug": "cosnitch-cve-2026-24301-one-click-drained-your-gmail-through-copilot", "title": "CoSnitch CVE-2026-24301: One Click Drained Your Gmail Through Copilot", "summary": "Varonis Threat Labs disclosed on August 18 a three-vulnerability chain, CVE-2026-24301, nicknamed CoSnitch, that let attackers gain full read access to Gmail, Google Drive, and Outlook through Microsoft Copilot with a single click and no confirmation prompt; Microsoft patched it server-side the same day. The attack exploited an undocumented 'autorun=1' URL parameter, prompt injection via web summarization, and persistent memory poisoning that survived password changes and session revocations. Varonis discovered the flaw by asking Copilot how to hack itself, and August 2026 also saw two other Copilot-family vulnerabilities: CVE-2026-59118 (CVSS 9.3) and CVE-2026-70335 (CVSS 7.8).", "body_md": "A single click on a crafted link handed attackers full read access to your Gmail, Google Drive, and Outlook — silently, through Microsoft Copilot, with no confirmation prompt. Varonis Threat Labs disclosed the three-vulnerability chain on August 18 as [CVE-2026-24301, nicknamed CoSnitch](https://www.varonis.com/blog/cosnitch). Microsoft patched it server-side the same day. No update required on your end. But if you clicked a suspicious Copilot link before August 18, your assistant’s memory may still be poisoned.\n\n## How the Attack Worked\n\nCoSnitch is not one bug. It’s three weaknesses chained to create a nearly invisible attack path.\n\nThe first link: an undocumented `autorun=1`\n\nURL parameter, combined with Copilot’s standard `?q=`\n\nquery string, caused any attacker-supplied prompt to execute automatically when the page loaded. A victim only needed to click a link — no paste, no confirmation, no tool approval. The attacker’s crafted URL looked like `copilot.microsoft.com/?q=[malicious prompt]&autorun=1`\n\n.\n\nThe second link: Copilot’s web summarization feature. When asked to summarize a page, Copilot retrieved the full content — including HTML comments and hidden metadata. Attackers embedded prompt injection payloads in those hidden elements. Copilot processed them as instructions.\n\nThe third link, and the most durable: persistent memory poisoning. Once the injected prompt ran, it wrote malicious rules to Copilot’s long-term memory — rules that survived password changes, session revocations, and device re-enrollment. Clean session, same backdoor.\n\n## What Was Exposed\n\nWith access to connected OAuth apps, the attack could pull:\n\n- Gmail and Outlook email content, including sender, recipient, and body\n- Google Calendar meeting details\n- Google Drive file metadata\n- Copilot chat history\n- Previously saved memory entries and custom instructions\n\nThe exfiltrated data was base64-encoded and sent as routine web requests — indistinguishable from normal Copilot browsing activity, invisible to standard DLP rules.\n\n## Copilot Explained the Attack Itself\n\nThe most unsettling part of this disclosure is how Varonis found it. They did not reverse-engineer Copilot’s backend or intercept network traffic in a lab. They asked Copilot how to hack Copilot.\n\nResearchers repeatedly prompted the assistant with variations of “why can’t prompts auto-execute on page load?” and “what would technically enable that?” Copilot, trained on Microsoft’s own developer documentation, described the URL parameter structure that made it possible. [The Register’s headline put it bluntly](https://www.theregister.com/research/2026/08/18/copilot-tricked-into-telling-reseachers-how-to-hack-itself/5288857): “Copilot tricked into telling researchers how to hack itself.”\n\nVaronis calls this meta-hacking — using an AI’s own training data to surface its attack surface. It worked. That should make every AI security team uncomfortable.\n\n## This Is Not a One-Off\n\nAugust 2026 alone delivered three separate Copilot-family vulnerabilities. CVE-2026-59118 is an elevation of privilege in Copilot Cowork with a CVSS score of 9.3. CVE-2026-70335 is an OS command injection in GitHub Copilot and VS Code, patched in [August Patch Tuesday](https://thehackernews.com/2026/08/microsoft-copilot-personal-flaws-could.html), CVSS 7.8. And in 2025, CVE-2025-53773 was a wormable RCE in GitHub Copilot via prompt injection.\n\nThe pattern is clear: any AI assistant that can browse the web, read documents, or access connected accounts has a prompt injection attack surface. Every new capability — summarization, memory, OAuth connections — expands that surface. Security tooling has not kept pace. Standard WAFs, DLP systems, and SIEM rules do not catch base64-encoded data leaving through an AI session.\n\n## What to Do Now\n\nMicrosoft’s patch is server-side — you need no action if you haven’t been exposed. But two things are worth doing regardless:\n\n**Audit your Copilot memory.** Navigate to copilot.microsoft.com, open Settings, and review the Memory section. Delete any entries you did not create or that look unfamiliar. This is the only way to clear a pre-patch memory poisoning payload.\n\n**Audit connected apps.** Review which OAuth connections Copilot has to Gmail, Drive, Calendar, and Outlook. Remove any you do not actively use. The attack only works if the connected apps are present — reducing that surface reduces future exposure from similar vulnerabilities.\n\nThe broader lesson is that a URL with `autorun=1`\n\nshould never have existed in an assistant with OAuth access to your email. “Secure by default” for AI assistants means no auto-execution of externally-supplied prompts, full stop. That this was found by asking the AI itself is the most damning part of the story.", "url": "https://wpnews.pro/news/cosnitch-cve-2026-24301-one-click-drained-your-gmail-through-copilot", "canonical_source": "https://byteiota.com/cosnitch-cve-2026-24301-one-click-drained-your-gmail-through-copilot/", "published_at": "2026-08-27 02:07:52+00:00", "updated_at": "2026-08-27 02:20:01.695695+00:00", "lang": "en", "topics": ["ai-safety", "ai-policy", "ai-products"], "entities": ["Varonis Threat Labs", "Microsoft Copilot", "CVE-2026-24301", "CVE-2026-59118", "CVE-2026-70335", "Gmail", "Google Drive", "Outlook"], "alternates": {"html": "https://wpnews.pro/news/cosnitch-cve-2026-24301-one-click-drained-your-gmail-through-copilot", "markdown": "https://wpnews.pro/news/cosnitch-cve-2026-24301-one-click-drained-your-gmail-through-copilot.md", "text": "https://wpnews.pro/news/cosnitch-cve-2026-24301-one-click-drained-your-gmail-through-copilot.txt", "jsonld": "https://wpnews.pro/news/cosnitch-cve-2026-24301-one-click-drained-your-gmail-through-copilot.jsonld"}}