# Microsoft Patches 'CoSnitch' Copilot Flaw That Let One Click Steal Connected-App Data

*2026-08-22 22:01 UTC · Technology · 1 min read*

> A chained Copilot Personal vulnerability dubbed CoSnitch let one click silently pull data from connected Gmail, Drive and Calendar accounts before Microsoft patched it on August 18, 2026.

Varonis Threat Labs disclosed a chain of three vulnerabilities in Microsoft Copilot Personal, collectively named "CoSnitch," that let a single malicious link silently exfiltrate data from a user's connected apps. Microsoft shipped the fix on August 18, 2026, roughly eight months after Varonis reported the issue in December 2025.

The attack relied on an undocumented URL parameter, autorun=1, that Varonis says it uncovered through "meta-hacking" — repeatedly pressing Copilot on why automatic prompt execution was supposedly impossible until it revealed the parameter and the conditions needed to trigger it. A victim who simply asked Copilot to summarize a booby-trapped webpage would have hidden instructions in the page's HTML executed automatically, pulling data from connected services including Gmail, Google Drive and Google Calendar, plus conversation history and saved memory.

Tracked as CVE-2026-24301 with a severity score of 8.8 out of 10, the flaw chained automatic prompt execution, exfiltration through authorized connections, and persistent memory poisoning. Varonis said it found no evidence the bug was exploited before the patch shipped, but summed up the risk bluntly: Copilot "wasn't breached; it was played."

## Sources

- [thehackernews.com](https://thehackernews.com/2026/08/microsoft-copilot-personal-flaws-could.html)
- [varonis.com](https://www.varonis.com/blog/cosnitch)

---
TechTools News · https://techtools.cz/tools/news/article/2236-microsoft-patches-cosnitch-copilot-flaw-that-let-one-click-steal-connected-app
Česká verze: https://techtools.cz/tools/news/clanek/2309-microsoft-opravil-chybu-cosnitch-v-copilotu-jedno-kliknuti-mohlo-ukrast-data-z