What is the difference between CoSnitch, SearchLeak and the Warp attack?

All three abuse an AI assistant's retrieval behaviour, but at different layers. SearchLeak (CVE-2026-42824, June 2026) leaked data through Copilot's search and retrieval path. The Warp attack (Cornell, June 2026) poisoned the corpus a web agent retrieves from, so the agent fetches attacker content believing it is legitimate. CoSnitch (CVE-2026-24301, August 2026) chained an injected link, Copilot's built-in URL fetch and persistent memory poisoning, making the compromise survive past the original session.

Which of these AI agent attacks is most dangerous?

CoSnitch, because of persistence. SearchLeak and Warp are largely bounded by the session or query in which they occur, while CoSnitch could write attacker instructions into Copilot's long-term memory through summarised web content. That turns a single click into a standing condition affecting later, unrelated conversations.

Are these vulnerabilities patched?

The two CVEs are. Microsoft patched CoSnitch (CVE-2026-24301) server-side on August 18, 2026, and SearchLeak (CVE-2026-42824) was addressed after its June 2026 disclosure. The Warp attack is different in kind — it is a research technique against retrieval-augmented web agents rather than a single vendor bug, so there is no vendor patch that closes it; it is mitigated by architecture.

How do I defend against this whole class of attack?

Treat every retrieved artifact as untrusted data rather than instructions, restrict which connectors an assistant can reach, gate writes to persistent memory behind explicit user confirmation, and monitor assistant-initiated outbound fetches as a potential exfiltration channel. No single control is sufficient, because each attack enters at a different layer of the same pipeline.

Quick Answer

CoSnitch vs SearchLeak vs Warp: AI Agent Attacks 2026

Published: August 22, 2026

The Short Answer

Three attacks on AI assistants landed in 2026, and they are commonly lumped together as “prompt injection.” They are not the same thing. They hit different layers of the same retrieval pipeline.

	SearchLeak	Warp	CoSnitch
Identifier	CVE-2026-42824	Research technique (Cornell)	CVE-2026-24301
Disclosed	June 2026	June 2026	August 2026
Target	Microsoft Copilot	Web agents generally	Microsoft Copilot Personal
Layer attacked	Retrieval / search path	The retrieved corpus	Link → fetch → memory
Persistence	Session-bound	Corpus-bound	Survives the session
Vendor patch	Yes	N/A (architectural)	Yes — Aug 18, 2026
Fix type	Vendor-side	Your design	Server-side

Verified August 22, 2026.

The Pipeline They All Attack

Every 2026 assistant runs roughly the same loop: take a user request → retrieve external context → reason over it → optionally act or write to memory.

That loop has a foundational weakness. Retrieved content arrives in the same context window as the user’s instructions, and the model has no reliable, structural way to distinguish “data I was asked to read” from “instructions I should follow.” Each of these three attacks enters at a different point in that loop.

SearchLeak — Attacking The Retrieval Path

CVE-2026-42824, disclosed June 2026 against Microsoft Copilot.

SearchLeak abused the assistant’s own search and retrieval behaviour to surface information the requesting user should not have been able to reach. The insight is that a retrieval system tends to be more permissive than the interface in front of it: the index knows about content that the UI would ordinarily gate, and an assistant querying that index on the user’s behalf can become an unintended reader.

Blast radius: whatever the retrieval index covers. Persistence: low — bounded to the queries that trigger it. Defence: enforce permissions at the retrieval layer, not the presentation layer. If your index does not carry per-document access control that is evaluated at query time, your assistant is a permissions bypass waiting to be found.

Warp — Attacking The Corpus

Published by Cornell researchers in June 2026, targeting retrieval-augmented web agents in general.

Warp inverts the usual assumption. Rather than attacking the agent, it poisons what the agent retrieves. Plant content that ranks well for the queries an agent is likely to issue, and the agent will fetch it, trust it, and act on it — having done nothing wrong by its own logic.

This is the most structurally troubling of the three, because there is no vendor to patch it. The agent behaved correctly. The internet was the vulnerability.

Blast radius: any agent whose retrieval touches attacker-reachable content — which in practice means any agent with web access. Persistence: as long as the poisoned content ranks. Defence: source allowlisting for high-privilege actions, provenance tracking on retrieved claims, and never letting a single retrieved document authorise a consequential action on its own.

CoSnitch — Attacking Memory

CVE-2026-24301, disclosed and patched August 18, 2026, against Microsoft Copilot Personal.

CoSnitch is the most complete of the three because it chains three stages: an undocumented URL parameter that injects attacker instructions from a single click; Copilot’s built-in URL fetch, repurposed as an outbound channel that encoded Gmail, Drive and Calendar data into requests made by Microsoft’s own infrastructure; and persistent memory poisoning via web summarisation, which wrote attacker instructions into Copilot’s long-term memory.

Varonis reported the issue in December 2025 and found no evidence of exploitation in the wild. Microsoft’s fix was server-side, so users had nothing to install.

Blast radius: every connected account — the assistant itself held no secrets, the connectors did. Persistence: high. This is the differentiator. The victim closes the tab and the instruction remains. Defence: gate memory writes behind explicit confirmation, and never let content that originated from a summarised web page write to durable memory.

The Trend Line: From Injection To Persistence

Read chronologically, 2026 shows a clear escalation:

Read attacks (SearchLeak, June) — get the assistant to reveal something.
Trust attacks (Warp, June) — get the assistant to believe something.
Persistence attacks (CoSnitch, August) — get the assistant to keep believing something.

Traditional security has seen this arc before; it is roughly the path from information disclosure to stored XSS. The defensive lesson is the same one that took the web a decade to learn: the durability of the payload matters more than its cleverness. A brilliant one-shot injection is an incident. A mediocre injection that writes to memory is a foothold.

The Defence Matrix

Because each attack enters at a different layer, no single control covers all three.

Control	SearchLeak	Warp	CoSnitch
Permission checks at query time	✅	➖	➖
Source allowlisting for actions	➖	✅	➖
Retrieved content ≠ instructions	✅	✅	✅
Confirmed writes to memory	➖	➖	✅
Egress monitoring on agent fetches	➖	➖	✅
Least-privilege connectors	✅	➖	✅

The single row that helps against all three is the architectural one: retrieved content is data, never instructions. Everything else is defence in depth around that principle.

What To Do This Quarter

If you deploy assistants to a workforce, three concrete moves:

Inventory your connectors. CoSnitch’s damage came entirely from Gmail, Drive and Calendar. List what each assistant can reach and remove anything not actively used.
Audit persistent memory. Can summarised web content write to it? If yes, that is the CoSnitch precondition, in your environment, today.
Log assistant-initiated fetches. Outbound requests made by the vendor’s cloud on your behalf will not appear in your egress monitoring. Ask your vendor what visibility exists — the answer is frequently “none,” and that is worth knowing before an incident rather than during one.