Microsoft Copilot CoSnitch vulnerability disclosed: one click to exfiltrate email

Security firm Varonis disclosed Microsoft Copilot vulnerability CoSnitch on August 18, 2026 (CVE-2026-24301, CVSS 3.1 score 8.8). The vulnerability chains three flaws: automatic prompt execution, OAuth connector abuse, and persistent memory poisoning.Attackers craft a malicious link like copilot.microsoft.com/?q=&autorun=1. When the victim clicks, the browser loads Copilot in an authenticated session. The autorun=1 parameter triggers automatic execution, and the prompt in ?q= runs without any user gesture.Attackers can continue multi-step execution even after the victim closes the tab, exfiltrating results Base64-encoded to an attacker-controlled webhook. Varonis also showed that malicious instructions could be embedded in page metadata to poison Copilot's persistent memory, surviving password changes and session revocation.Varonis dubbed the discovery method "meta-hacking". Researchers repeatedly asked Copilot why automatic execution should be impossible, and the assistant explained enough of its own URL handling and historical protections to expose the undocumented parameter.The vulnerability was patched on August 18, 2026. Varonis first disclosed in December 2025, with the patch taking about 8 months. Microsoft reports no evidence of in-the-wild exploitation and says enterprise customers were unaffected, with only Copilot Personal impacted. This is the third Copilot flaw Varonis has disclosed this year.