CoSnitch is the name Varonis Threat Labs gave to a chained vulnerability in Microsoft Copilot Personal, tracked by Microsoft as CVE-2026-24301, an information disclosure flaw affecting Copilot on the web. A single click on a malicious link could cause Copilot to exfiltrate data from a user's connected Gmail, Drive and Calendar, and could persistently poison Copilot's long-term memory. Microsoft shipped a server-side fix on August 18, 2026.

Is CoSnitch patched, and do I need to do anything?

Yes, it is patched, and there is no user action required. Microsoft fixed CVE-2026-24301 server-side on August 18, 2026, so the remediation applied automatically to all Copilot web users with no update to install. Varonis reported finding no evidence that the flaw was exploited in the wild before the patch.

Why did the CoSnitch fix take so long?

Varonis says it reported the issue to Microsoft in December 2025, and the patch shipped on August 18, 2026 — roughly eight months later. Long timelines are common for AI assistant bugs because the fix is usually a behavioural change in a live model-plus-tooling system rather than a code patch, and each mitigation has to be tested against regressions in normal assistant behaviour.

Does CoSnitch affect assistants other than Copilot?

The specific CVE applies to Microsoft Copilot, but the underlying techniques are not Microsoft-specific. Varonis noted the approach may affect other AI models, because the ingredients — a built-in URL fetcher, connected data sources, and a persistent memory that can be written to from summarised web content — are present in most 2026 assistants including ChatGPT and Claude.

Quick Answer

What Is CoSnitch? Copilot CVE-2026-24301 Explained

Published: August 22, 2026

The Short Answer

CoSnitch is a critical, chained vulnerability in Microsoft Copilot Personal, disclosed by Varonis Threat Labs and tracked by Microsoft as CVE-2026-24301 — an information disclosure flaw affecting Copilot on the web.

One click on a malicious link was enough to make Copilot quietly hand over data from a victim’s connected accounts, and to leave a lasting instruction behind in its memory.

Field	Detail
Name	CoSnitch (Varonis Threat Labs)
CVE	CVE-2026-24301
Severity	Critical
Product	Microsoft Copilot Personal (web)
Class	Information disclosure / prompt injection chain
Reported	December 2025
Patched	August 18, 2026, server-side
Exploited in the wild?	No evidence found by Varonis

Verified August 22, 2026.

Where The Name Comes From

The memorable part of CoSnitch is not the payload — it is the discovery method.

Varonis researchers got Copilot to describe its own internals. By repeatedly asking the assistant questions about itself, its parameters and how it handled links, they mapped enough of its behaviour to construct an attack against it. Copilot, in effect, snitched on itself. The Register summarised it as social-engineering an AI’s reasoning engine rather than exploiting a memory-safety bug.

This matters beyond the joke. It means the reconnaissance phase of an AI assistant attack can be performed through the product’s normal chat interface, leaving no unusual network traffic and tripping no conventional security tooling.

How The Attack Chain Worked

CoSnitch was a chain, not a single bug. Three pieces had to line up.

1. An undocumented URL parameter

Copilot accepted a URL parameter that was not part of its public interface and that allowed content to be injected into a conversation. This is the delivery vehicle: an attacker crafts a link, and the victim’s click seeds the conversation with attacker-controlled instructions.

2. Copilot’s built-in URL fetch

Copilot can retrieve and summarise web pages. Once attacker instructions were in the conversation, that fetch capability became an outbound channel: instruct the assistant to retrieve a URL with victim data appended to it, and the data leaves the tenant inside an ordinary-looking web request made by Microsoft’s own infrastructure.

The instructions Varonis demonstrated were blunt — pull every email address found in Gmail, any passwords or secrets in message bodies, the contents of the Drive folder, and every event in the Calendar.

3. Persistent memory poisoning via web summarisation

The third stage is the one that should worry security teams most. Instructions embedded in a summarised web page could be written into Copilot’s persistent memory.

That converts a one-time click into a standing condition. The victim closes the tab, comes back the next day, starts an unrelated conversation — and the assistant is still carrying the attacker’s instruction, because memory survives the session that planted it.

Why This Class Of Bug Is Hard To Fix

CVE-2026-24301 took roughly eight months from report (December 2025) to patch (August 18, 2026). That looks slow next to a typical server-side web fix, and the reason is structural.

There is no single line of vulnerable code. The exploit lives in the interaction between three features that are each working as designed: link handling, web fetching, and memory. Removing any one of them removes real product value. So the fix has to be a behavioural boundary — treat retrieved web content as untrusted data rather than instructions — and every attempt at that boundary has to be regression-tested against the assistant’s normal, useful behaviour.

Microsoft’s remediation was server-side, which is the one genuinely good property of assistant vulnerabilities: there was nothing for users to install. The fix applied to everyone at once on August 18, 2026.

What CoSnitch Means If You Deploy AI Assistants

Three durable lessons, none of which expire with this patch:

Connected accounts are the blast radius. Copilot itself held no secrets. The damage came from Gmail, Drive and Calendar connectors. Every integration you enable widens what a single successful injection can reach — audit connectors as if each one were a service account.

Memory is state, and state is an attack surface. Persistent memory is marketed as a convenience feature. Architecturally it is a writable store that untrusted content can reach through summarisation. Assume anything summarised from the open web can attempt to write to it.

Built-in fetchers are exfiltration channels. Any assistant that can retrieve a URL can encode data into that URL. Network egress controls that only inspect the user’s traffic will miss it entirely, because the request originates from the vendor’s cloud.

CoSnitch is the third significant AI assistant attack disclosed in 2026, following a clear pattern:

SearchLeak (CVE-2026-42824, June 2026) — also Microsoft Copilot, also data disclosure through the assistant’s own retrieval behaviour.
The Warp attack (Cornell, June 2026) — retrieval poisoning against web agents, demonstrating that the retrieved corpus itself can be the weapon.
CoSnitch (CVE-2026-24301, August 2026) — combining injection, fetch-based exfiltration, and persistent memory.

The trajectory is unmistakable: attacks are moving from one-shot injection toward persistence. CoSnitch is the first widely-publicised case where the payload outlives the session that delivered it.