# CoSnitch CVE-2026-24301: One Click Drained Your Gmail Through Copilot > Source: > Published: 2026-08-27 02:07:52+00:00 A single click on a crafted link handed attackers full read access to your Gmail, Google Drive, and Outlook — silently, through Microsoft Copilot, with no confirmation prompt. Varonis Threat Labs disclosed the three-vulnerability chain on August 18 as [CVE-2026-24301, nicknamed CoSnitch](https://www.varonis.com/blog/cosnitch). Microsoft patched it server-side the same day. No update required on your end. But if you clicked a suspicious Copilot link before August 18, your assistant’s memory may still be poisoned. ## How the Attack Worked CoSnitch is not one bug. It’s three weaknesses chained to create a nearly invisible attack path. The first link: an undocumented `autorun=1` URL parameter, combined with Copilot’s standard `?q=` query string, caused any attacker-supplied prompt to execute automatically when the page loaded. A victim only needed to click a link — no paste, no confirmation, no tool approval. The attacker’s crafted URL looked like `copilot.microsoft.com/?q=[malicious prompt]&autorun=1` . The second link: Copilot’s web summarization feature. When asked to summarize a page, Copilot retrieved the full content — including HTML comments and hidden metadata. Attackers embedded prompt injection payloads in those hidden elements. Copilot processed them as instructions. The third link, and the most durable: persistent memory poisoning. Once the injected prompt ran, it wrote malicious rules to Copilot’s long-term memory — rules that survived password changes, session revocations, and device re-enrollment. Clean session, same backdoor. ## What Was Exposed With access to connected OAuth apps, the attack could pull: - Gmail and Outlook email content, including sender, recipient, and body - Google Calendar meeting details - Google Drive file metadata - Copilot chat history - Previously saved memory entries and custom instructions The exfiltrated data was base64-encoded and sent as routine web requests — indistinguishable from normal Copilot browsing activity, invisible to standard DLP rules. ## Copilot Explained the Attack Itself The most unsettling part of this disclosure is how Varonis found it. They did not reverse-engineer Copilot’s backend or intercept network traffic in a lab. They asked Copilot how to hack Copilot. Researchers repeatedly prompted the assistant with variations of “why can’t prompts auto-execute on page load?” and “what would technically enable that?” Copilot, trained on Microsoft’s own developer documentation, described the URL parameter structure that made it possible. [The Register’s headline put it bluntly](https://www.theregister.com/research/2026/08/18/copilot-tricked-into-telling-reseachers-how-to-hack-itself/5288857): “Copilot tricked into telling researchers how to hack itself.” Varonis calls this meta-hacking — using an AI’s own training data to surface its attack surface. It worked. That should make every AI security team uncomfortable. ## This Is Not a One-Off August 2026 alone delivered three separate Copilot-family vulnerabilities. CVE-2026-59118 is an elevation of privilege in Copilot Cowork with a CVSS score of 9.3. CVE-2026-70335 is an OS command injection in GitHub Copilot and VS Code, patched in [August Patch Tuesday](https://thehackernews.com/2026/08/microsoft-copilot-personal-flaws-could.html), CVSS 7.8. And in 2025, CVE-2025-53773 was a wormable RCE in GitHub Copilot via prompt injection. The pattern is clear: any AI assistant that can browse the web, read documents, or access connected accounts has a prompt injection attack surface. Every new capability — summarization, memory, OAuth connections — expands that surface. Security tooling has not kept pace. Standard WAFs, DLP systems, and SIEM rules do not catch base64-encoded data leaving through an AI session. ## What to Do Now Microsoft’s patch is server-side — you need no action if you haven’t been exposed. But two things are worth doing regardless: **Audit your Copilot memory.** Navigate to copilot.microsoft.com, open Settings, and review the Memory section. Delete any entries you did not create or that look unfamiliar. This is the only way to clear a pre-patch memory poisoning payload. **Audit connected apps.** Review which OAuth connections Copilot has to Gmail, Drive, Calendar, and Outlook. Remove any you do not actively use. The attack only works if the connected apps are present — reducing that surface reduces future exposure from similar vulnerabilities. The broader lesson is that a URL with `autorun=1` should never have existed in an assistant with OAuth access to your email. “Secure by default” for AI assistants means no auto-execution of externally-supplied prompts, full stop. That this was found by asking the AI itself is the most damning part of the story.