As reported by The Hacker News, Varonis Threat Labs has disclosed three vulnerabilities in Microsoft Copilot Personal — collectively named CoSnitch and tracked as CVE-2026-24301 — that could allow a single click on a crafted link to silently exfiltrate data from a victim's connected apps. Microsoft patched the issues on August 18, 2026, roughly eight months after initial disclosure. No active exploitation has been observed.

AI Security Alert: As reported by The Hacker News, Varonis Threat Labs has disclosed three vulnerabilities in Microsoft Copilot Personal — collectively named CoSnitch and tracked as CVE-2026-24301 — that could allow a single click on a crafted link to silently exfiltrate data from a victim's connected apps.

Vulnerability Details

FieldDetail
CVECVE-2026-24301
SeverityNot yet rated publicly at time of writing; Microsoft classified as requiring Security Update Guide patch
Affected ProductMicrosoft Copilot Personal (copilot.microsoft.com) — consumer version
Not Affected (per disclosure)Microsoft 365 Copilot (enterprise) — not confirmed affected
Patch StatusPatched August 18, 2026
Active ExploitationNone observed
ResearcherVaronis Threat Labs

Why This Matters Beyond the Patch

The most striking element of CoSnitch isn't the exfiltration path itself — it's how the researchers found it. Varonis describes repeatedly asking Copilot why a prompt couldn't run without user interaction, and the assistant eventually named the autorun=1 parameter along with the session conditions and protections that were supposed to disable it. As Varonis put it, Copilot "wasn't breached; it was played."

This is a new class of attack surface discovery: the AI assistant as its own vulnerability oracle. Security researchers — and threat actors — can interrogate LLM-based systems to extract implementation details, undocumented parameters, and security control logic that would traditionally require reverse engineering or source code access.

For defenders, this means the threat model for AI-integrated products now includes the possibility that the assistant itself will disclose sensitive architectural information to anyone who asks the right sequence of questions. Traditional threat modeling assumes attackers lack internal knowledge. With conversational AI embedded in the product, that assumption breaks.

The Connected-App Exfiltration Pattern

The second vulnerability in the chain is the more operationally significant one. Once automatic prompt execution fires via the crafted URL, the injected prompt can query any service the user has already authorized through Copilot — and exfiltrate the results via Copilot's own URL fetch capability to an attacker-controlled endpoint. The attack doesn't escalate privileges or grant new OAuth scopes; it simply leverages the authenticated session and the assistant's existing tool integrations.

This pattern will recur across every consumer and enterprise AI assistant that connects to third-party services. The combination of automatic prompt execution + connected data sources + outbound fetch capability creates a ready-made exfiltration triangle. Any product implementing all three needs compensating controls at each leg.

Immediate Actions

The Connected-App Exfiltration Pattern
Consumer users: No action required if you've used Copilot Personal after August 18, 2026 — the patch is live. Avoid clicking unsolicited Copilot links regardless, as similar patterns may emerge.
Enterprise security teams: Review whether Microsoft 365 Copilot or similar AI assistants in your environment expose automatic prompt execution paths. While M365 Copilot was not confirmed affected, the architectural pattern warrants independent validation.
Detection engineers: Monitor for outbound HTTP requests from AI assistant infrastructure to non-Microsoft domains, particularly POST requests containing encoded data from authorized service queries.
AI product teams: Treat your assistant's training data and system prompts as potential disclosure surfaces. Implement guardrails that prevent the model from revealing internal parameters, URL schemas, or security control logic.

Shield53 Recommendations

  • Audit connected app permissions: Review which third-party services are authorized for AI assistants in your environment. Reduce scope to business-essential integrations only.
  • Implement outbound fetch restrictions: If you operate AI infrastructure, restrict or sandbox the assistant's ability to make arbitrary outbound HTTP requests. Egress allowlisting defeats the exfiltration leg of this attack pattern.
  • Red-team your AI assistants: Include prompt-based interrogation of internal architecture in your security testing. If your assistant will disclose parameters and control logic to a persistent questioner, that's a finding — not a feature.
  • Monitor OAuth token usage: Watch for API calls originating from AI assistant infrastructure that access connected services at unusual volume or timing, which may indicate automated exfiltration.
  • Track the Reprompt lineage: Varonis's earlier Reprompt research used the same q parameter entry point. This is a recurring pattern in Copilot's URL handling — expect future variations and instrument detection accordingly.

The CoSnitch disclosure is a milestone less for the specific vulnerability than for what it demonstrates about AI-assisted attack surface discovery. When the product under test will describe its own weaknesses, the defender's advantage shifts. Security teams need to assume that any conversational AI in their stack is also a conversational intelligence source for adversaries.