One link, with no extra click, was enough for Microsoft Copilot Personal to run an attacker’s prompt, read connected email and files, and even store malicious instructions in its memory. Here is how CoSnitch worked and what it teaches about any assistant with connectors.
CoSnitch is the name Varonis Threat Labs gave to three chained vulnerabilities in Microsoft Copilot Personal, tracked as CVE-2026-24301 with a CVSS score of 8.8. According to the published analyses, Microsoft 365 Copilot Enterprise was not affected. Microsoft was notified in December 2025 and fixed the problem on August 18, 2026, on the server side, so users did not have to do anything. No in-the-wild exploitation has been reported.
The q parameter fills in Copilot’s input box. While analyzing Copilot’s share feature, Varonis discovered an undocumented parameter, autorun=1, which that feature uses to run shared prompts. Combined, a crafted link made Copilot execute the attacker’s prompt the moment the page loaded, with no button and no confirmation dialog, inside an already authenticated session.
The injected prompt could query the apps the user had already authorized: email, calendar, Google Drive files and past conversations. It then encoded whatever it found inside a URL and handed that URL to Copilot’s web summarization feature, so the data left the environment in a request the assistant itself made on the user’s behalf. No malware involved: the assistant was the channel.
Instructions embedded in a web page could, when Copilot summarized that page, be written into the user’s memory store. According to the analyses, that persistence survived password changes and session revocation. That is the difference between a one-off prompt injection and an implant.
Sources: Hexnode, PointGuard AI, Hackmag, Aviatrix, Varonis Threat Labs analysis and the Q3 2026 summary from the OWASP GenAI Security Project. Details verified across several independent sources.
Carlos Montiel is an enterprise AI solutions architect. He implements LLMs, Agents, RAG, and orchestrators for companies across Guatemala and Latin America. Reach out for a consultation.
Contact Carlos Montiel