{"slug": "varonis-discloses-one-click-cosnitch-flaw-in-microsoft-copilot", "title": "Varonis Discloses One-Click CoSnitch Flaw in Microsoft Copilot", "summary": "Varonis Threat Labs disclosed CoSnitch on August 18, a one-click attack chain in Microsoft Copilot Personal that could automatically execute an attacker-supplied prompt, exfiltrate data through connected apps, and poison persistent memory. Microsoft received the report in December 2025 and shipped patches on August 18, 2026; Varonis found no evidence of exploitation in the wild.", "body_md": "# Varonis Discloses One-Click CoSnitch Flaw in Microsoft Copilot\n\nVaronis Threat Labs disclosed CoSnitch on August 18, a one-click chain in Microsoft Copilot Personal combining automatic prompt execution, data exfiltration through connected apps and persistent memory poisoning. Varonis says Microsoft received the report in December 2025 and shipped patches on August 18; the researchers found no evidence of exploitation in the wild.\n\nVaronis Threat Labs disclosed CoSnitch on August 18, a one-click attack chain affecting Microsoft Copilot Personal. The researchers say the chain could automatically execute an attacker-supplied prompt, retrieve information through connected apps and send it to an external server, or poison Copilot's persistent memory.\n\nVaronis reported the issue to Microsoft in December 2025 and says patches shipped on August 18, 2026. The company said it had seen no evidence of exploitation in the wild. The Register, which reviewed the research before publication, reported that Microsoft did not respond to its request for comment before deadline.\n\n### How Copilot revealed the attack path\n\nThe researchers call their discovery technique \"meta-hacking.\" They repeatedly asked Copilot why automatic prompt execution would not work. While refusing the request, the assistant described disabled URL behavior and disclosed an undocumented autorun=1 parameter. Varonis then combined that parameter with Copilot's q query parameter and found that a crafted link could execute a prompt when opened in an authenticated session without a separate confirmation.\n\nThat automatic execution supplied the first step. A malicious prompt could then ask Copilot to search connected Gmail, Drive, Calendar or chat data, place a result into a URL, and use Copilot's URL-fetch behavior to send it to an attacker-controlled endpoint. Varonis emphasizes that the connected service is not being bypassed: Copilot is exercising access the user already granted, but without the user knowingly initiating the resulting action.\n\nThe researchers also demonstrated a persistent-memory path in which instructions embedded in a webpage could be written into Copilot's cross-session memory when the page was summarized. Varonis says those instructions survived password changes, session revocation and device re-enrollment in its tests.\n\n### Why the chain matters\n\nCoSnitch combines product behavior, authenticated connectors and model interpretation rather than relying on a conventional network intrusion. That makes a normal-looking link the delivery mechanism and a trusted assistant the execution surface. For teams deploying connected copilots, the practical controls are explicit confirmation for stateful actions, narrow connector scopes, separation of retrieved data from instructions, and telemetry that correlates agent actions with unexpected external fetches.\n\nThe disclosure is specific to the patched Copilot Personal behavior tested by Varonis. It should not be generalized into evidence that every Copilot deployment or connector was exploited.\n\n## Key Points\n\n- 1Varonis says a crafted link could trigger an attacker-supplied Copilot prompt without a separate user confirmation.\n- 2The demonstrated chain used Copilot's authorized connectors and URL-fetch behavior to retrieve and exfiltrate data.\n- 3Microsoft shipped patches on August 18, according to Varonis, which found no evidence of in-the-wild exploitation.\n\n## Scoring Rationale\n\nThe research documents a patched one-click chain combining automatic prompt execution, privileged connectors and persistent memory. Its practical significance is high for connected-assistant security, while the score remains below catastrophic because Varonis reports no observed exploitation in the wild.\n\n## Sources\n\nPrimary source and supporting public references used for this report.\n\nPractice interview problems based on real data\n\n1,625 SQL & Python problems across 15 industry datasets — the exact type of data you work with.\n\n[Try 250 free problems](/problems)", "url": "https://wpnews.pro/news/varonis-discloses-one-click-cosnitch-flaw-in-microsoft-copilot", "canonical_source": "https://letsdatascience.com/news/varonis-discloses-one-click-cosnitch-flaw-in-microsoft-copil-1a0e4921", "published_at": "2026-08-18 13:01:55+00:00", "updated_at": "2026-08-18 17:12:29.680564+00:00", "lang": "en", "topics": ["ai-safety", "ai-products", "ai-agents"], "entities": ["Varonis Threat Labs", "Microsoft", "Microsoft Copilot Personal", "CoSnitch", "The Register"], "alternates": {"html": "https://wpnews.pro/news/varonis-discloses-one-click-cosnitch-flaw-in-microsoft-copilot", "markdown": "https://wpnews.pro/news/varonis-discloses-one-click-cosnitch-flaw-in-microsoft-copilot.md", "text": "https://wpnews.pro/news/varonis-discloses-one-click-cosnitch-flaw-in-microsoft-copilot.txt", "jsonld": "https://wpnews.pro/news/varonis-discloses-one-click-cosnitch-flaw-in-microsoft-copilot.jsonld"}}