New research from Varonis Threat Labs has documented several vulnerabilities in Microsoft’s Copilot Personal AI platform that can stealthily steal data from Copilot and connected apps, all without the user ever realizing what has happened.
Dubbed CoSnitch, all that’s necessary for the exploits to work is for a user to click on a compromised link. When that happens, Copilot executes the threat actor’s commands while keeping its actions hidden. As Varonis put it, it’s “three vulnerabilities, one click, and zero anomalous signals.”
The attack appears to be limited to the Copilot Personal platform, and the report does not state that it affects the Microsoft 365 version of Copilot. The technique used to find it is another matter: Varonis says meta-hacking applies to any agentic platform with a natural language interface.
The goal of the exploit was to get Copilot to run a prompt without any user interaction. The researchers asked Copilot why it could not operate this way and were rebuffed, but they continued to press the AI, reframing their question in different ways that narrowed down exactly why Copilot was pushing back on their attempts.
Eventually, Copilot revealed a hidden URL parameter that enables automatic execution, which allowed the researchers to build their exploits around this element. In other words, Varonis had manipulated Copilot into revealing its secret guardrails – hence the name CoSnitch.
Three separate attacks
Varonis was able to construct three different attacks that utilized the Copilot flaw. The first was a special URL that included the exploited parameters and a string of malicious code that allowed an attacker to steal information from Copilot and connected apps, poison session memory, map out user files and emails, and modify what Copilot showed the user. This all ran automatically as soon as a user clicked the infected link.
The second vulnerability concerned OAuth tokens linked to connected platforms such as Gmail. If these platforms are hooked up to Copilot, the flaw discovered by Varonis can wrangle Copilot into reading a user’s full email contents and exfiltrating key data – including user passwords and other sensitive information – to a server controlled by the hacker.
In the third instance, the researchers created a compromised web page that contained hidden malicious code. They then prompted Copilot to summarize the page, which caused the AI to read and execute the code while returning a legitimate summary. The code in question was written to Copilot’s persistent memory, enabling it to survive across user sessions and repeatedly do the attacker’s bidding – such as stealing data – without alerting anyone to its actions.
Although the flaw – designated as CVE-2026-24301 and identified by Varonis in December 2025 – was patched on August 18, 2026 and does not appear to have been exploited in the wild, Varonis still had some tips on how to protect your organization.
Companies should review whether every app connected to Copilot is truly necessary and whether their current toolset would detect unusual access patterns of the type demonstrated by Varonis.
As well as that, Copilot should be treated as a privileged insider – and handled with appropriate caution – while security teams were also encouraged to assess whether Copilot’s URLs need additional scrutiny.
