Copilot Told Researchers How to Hack It. Microsoft Patched Eight Months Later.
Varonis Threat Labs' CoSnitch chain turned Microsoft Copilot Personal into its own whistleblower, exposing an undocumented autorun parameter that made one-click data theft possible.
On August 18, Microsoft shipped a server-side patch for CVE-2026-24301, a one-click vulnerability chain in Copilot Personal rated 8.8 on CVSS 3.1. Varonis Threat Labs, which calls the chain CoSnitch, reported it in December 2025. Eight months of exposure for a critical bug isn’t a scheduling accident; it’s a disclosure of how Microsoft ranks its consumer AI surface against everything else in its patch queue.
The most interesting part isn’t the patch. It’s how Varonis found the bug.
Researchers simply asked Copilot how Copilot worked, over and over, in what the firm describes as “meta-hacking.” The assistant obliged. It explained, per Varonis, that “user intent is required and prompts do not fire on their own,” then proceeded to enumerate the exact parameters that were disabled, the security protections in place, and a previously undocumented URL parameter called autorun=1. Paired with the existing ?q= parameter, autorun=1 causes an attacker-supplied prompt to execute on page load inside the victim’s authenticated session, with the same capabilities as anything the user typed themselves. The prompt runs to completion even if the victim closes the tab. Connected Gmail, Google Drive, and Google Calendar accounts are all in reach.
A third link in the chain is worse than the click. Varonis found that a malicious webpage, once summarized by Copilot, can write hidden instructions into the assistant’s long-term memory. Those instructions survive password resets, session revocation, and device re-enrollment. Cleanup, in other words, doesn’t clean.
Microsoft’s response, sent to Dark Reading, was that no customer action is required and enterprise customers are unaffected because the flaw only touched Copilot Personal. Varonis senior security researcher Lior Adar pushed back directly: “The specific vulnerabilities we found are in the Personal version, that’s correct. But the person using Copilot Personal is the same person who walks into your office Monday morning.” Varonis recommends treating Copilot as a privileged identity, governed like a service account, with an audit of every third-party app wired into the assistant.
CoSnitch is the third Copilot bug Varonis has reported to Microsoft this year, after Reprompt and SearchLeak. No in-the-wild exploitation has been observed. What has been observed is a pattern: an AI assistant candid enough to narrate its own attack surface, and a vendor comfortable letting a CVSS 8.8 sit for two-thirds of a year because the affected SKU says “Personal” on the box.