CVE-2026-24301 (CoSnitch): Microsoft Copilot had a hidden autorun parameter that silently exfiltrated emails, calendar data and Drive files for 8 months

On August 18, 2026, Varonis Threat Labs published a report on three chained vulnerabilities in Microsoft Copilot Personal, catalogued as CVE-2026-24301 and named CoSnitch. One crafted URL was enough no further interaction required. Copilot would execute the embedded prompt, pull data from every connected OAuth account (Gmail, Google Calendar, Google Drive) and write persistent rules into its own memory. Rules that survived password resets, session revocation, and device re-enrollment.

Microsoft received the disclosure in December 2025. The patch shipped eight months later.

What is CoSnitch?

CoSnitch (CVE-2026-24301) is a chain of three vulnerabilities in Microsoft Copilot Personal, disclosed by Varonis Threat Labs on August 18, 2026. An attacker sends a crafted URL with ?q=prompt&autorun=1. Copilot executes the prompt automatically, pulls data from connected OAuth apps (Gmail, Calendar, Drive), and writes persistent rules to its long-term memory, all without user interaction beyond clicking the link.

The name comes from the discovery method. Researchers asked Copilot repeatedly why prompts couldn’t auto-run and what would technically make that possible. After enough rounds, the model disclosed the undocumented autorun=1 parameter, including how to use it.

How CVE-2026-24301 worked: three vulnerabilities chained

Vulnerability 1: automatic prompt execution via URL

Microsoft Copilot accepted prompts through URL parameters: ?q=<prompt text>&autorun=1. The browser executed the prompt on page load, with no confirmation dialog and no user action. The parameter worked even when the user closed the tab immediately after clicking the link.

An attacker could deliver the URL by email, chat message, or embedded in a webpage as a hidden redirect.

Vulnerability 2: silent OAuth data exfiltration

Once the prompt ran, Copilot queried all connected OAuth apps and encoded the results in URLs sent to attacker-controlled servers, masked as routine web summarization requests. In testing, Varonis exfiltrated:

• Email bodies and metadata (senders, subjects, message snippets)
• Calendar events with attendee lists and meeting times
• Google Drive filenames
• Full Copilot conversation history
• Existing memory store rules

Vulnerability 3: persistent memory poisoning

Malicious instructions injected through the crafted prompt could write themselves to Copilot’s long-term memory as standing rules. They persisted through password changes, session revocation, device re-enrollment, and account sign-out.

Removing them required manually reviewing and deleting memory rules, which first required knowing an attack had occurred.

How researchers found the hidden parameter: meta-hacking

Varonis used a technique that can be called meta-hacking: instead of analyzing source code, they asked Copilot about its own constraints. Specifically, why a prompt couldn’t auto-execute and what would technically enable it.

After repeated rounds of questioning, the model disclosed the undocumented autorun=1 parameter, including a description of its behavior.

The AI agent attack surface: what CoSnitch reveals

CoSnitch is not an isolated case. It fits a pattern of attacks targeting the AI layer, the agent itself, rather than the underlying application. The table below maps the documented attack vectors against AI agents and copilots in 2025-2026.

Three observations from this pattern:

AI agents are the new attack surface. Every OAuth connection an agent holds, every memory store it maintains, and every undocumented parameter in its interface is a potential entry point. The application code may be hardened while the AI layer is wide open.

Meta-level disclosure is a real vector. Copilot revealed autorun=1 when asked repeatedly why it couldn’t auto-run prompts. This is not a failure of prompt injection filtering, it’s the model responding helpfully to a question about its own capabilities. Any AI system that can introspect and explain its own behavior can potentially disclose undocumented functionality under sustained questioning.

Patch lag for AI vulnerabilities is long. Eight months from disclosure to patch is notable. For comparison, the average time-to-patch across all CVE categories was 60-90 days in 2025 (NVD data). AI-specific vulnerabilities may move slower because attack surface evaluation is less mature and remediation is more complex than patching a library.

Microsoft had 8 months

Varonis notified Microsoft in December 2025. The patch shipped August 18, 2026, on the same day as public disclosure.

Eight months is a long remediation window for a vulnerability requiring no user interaction beyond a link click, exfiltrating data from all connected OAuth apps in real time, and planting memory rules that outlasted password resets. Microsoft has not published an explanation of what extended the timeline.

What was patched

According to Varonis, as of August 18, 2026:

• autorun=1 no longer triggers automatic prompt execution
• Data exfiltration via encoded URLs is blocked
• Injecting rules into AI memory through external prompts is restricted

Varonis found no evidence of in-the-wild exploitation before the patch. That means no confirmed exfiltration, not proof that nobody else found the parameter independently during those eight months.

What to check now?

If you use Microsoft Copilot Personal with connected OAuth accounts:

1. Update to the latest version of Microsoft Copilot
2. Open memory settings and remove any rules you did not create
3. Review connected OAuth apps and disconnect anything you no longer use
4. Check activity logs in Gmail, Calendar, and Drive for unexpected access

For a broader look at how attackers are targeting the AI layer rather than application code, see our earlier piece on supply chain attacks against AI tools and code repositories.