Vulnerabilities & Exploits

Microsoft Copilot Patch Lands Amid Scope Dispute

Microsoft patched CoSnitch, CVE-2026-24301, in Copilot on August 18 after Varonis said it found an undocumented `autorun=1` parameter that let a crafted link run a prompt without a visible approval step. The reporting now splits on scope: Microsoft says only Copilot Personal was affected, while Ars Technica describes the exploit against Microsoft 365 Copilot Enterprise.

The trick was to ask Copilot why auto-run was blocked until it disclosed the hidden switch, then pair that parameter with the normal `q` field so the prompt fired as soon as the page loaded. In Varonis’ account, that could pull data from connected services and send it out through Copilot’s own URL-fetch behavior, all inside the user’s authenticated session.

That leaves the blast radius unresolved in public reporting, which matters for anyone treating Copilot as a cleanly segmented consumer or enterprise control. Even with Microsoft’s patch, the trust boundary is the story: a link can still become an execution path if your assistant can read connected apps and honor URL-driven input.

4 sources · Aug 19

CVE-2026-24301

NVD KEV

CVSS 8.8 HIGH: improper neutralization of special elements used in a command ('command injection') in Microsoft Copilot allows an…

Timeline

Aug 19 Reported by CSO Online

Sources

Aug 19 CSO Online
Microsoft finally patches critical one-click Copilot vulnerability, almost eight months after learning of it
Dubbed CoSnitch by the security researcher who discovered it, the flaw executes an attack chain that exfiltrates data from enterprises without any obvious red flags.
original
Aug 18 Dark Reading
'CoSnitch' Attack Tricked Copilot Into Revealing Own Architecture
Researchers discovered a "meta-hacking" technique that can manipulate the AI service into revealing its own security weaknesses.
original
Aug 18 The Hacker News
Microsoft Copilot Personal Flaws Could Let One Click Exfiltrate Data From Connected Apps
CVE-2026-24301 lets crafted Copilot Personal links auto-run prompts that can pull data from connected apps and exfiltrate it via URL fetches.
original

Vendor digest: Microsoft

Part of the PlainSec briefing for 2026-08-18

Every edition of this story: Microsoft Copilot Patch Lands Amid Scope Dispute

More from today

Vulnerabilities & ExploitsMicrosoft Copilot Patch Lands Amid Scope DisputeMicrosoft patched CoSnitch, CVE-2026-24301, in Copilot on August 18 after Varonis said it found an undocumented `autorun=1` parameter that let a crafted link run a prompt without a visible approval step. The reporting now splits on scope: Microsoft says only Copilot Personal was affected, while Ars Technica describes the exploit against Microsoft 365 Copilot Enterprise.The trick was to ask Copilot why auto-run was blocked until it disclosed the hidden switch, then pair that parameter with the normal `q` field so the prompt fired as soon as the page loaded. In Varonis’ account, that could pull data from connected services and send it out through Copilot’s own URL-fetch behavior, all inside the user’s authenticated session.That leaves the blast radius unresolved in public reporting, which matters for anyone treating Copilot as a cleanly segmented consumer or enterprise control. Even with Microsoft’s patch, the trust boundary is the story: a link can still become an execution path if your assistant can read connected apps and honor URL-driven input.4 sources · Aug 19

CVE-2026-24301

NVD KEV

CVSS 8.8 HIGH: improper neutralization of special elements used in a command ('command injection') in Microsoft Copilot allows an…

Timeline

Aug 19 Reported by CSO Online

Sources

Aug 19 CSO Online

Microsoft finally patches critical one-click Copilot vulnerability, almost eight months after learning of it

Dubbed CoSnitch by the security researcher who discovered it, the flaw executes an attack chain that exfiltrates data from enterprises without any obvious red flags.

original

Aug 18 Dark Reading

'CoSnitch' Attack Tricked Copilot Into Revealing Own Architecture

Researchers discovered a "meta-hacking" technique that can manipulate the AI service into revealing its own security weaknesses.

original

Aug 18 The Hacker News

Microsoft Copilot Personal Flaws Could Let One Click Exfiltrate Data From Connected Apps

CVE-2026-24301 lets crafted Copilot Personal links auto-run prompts that can pull data from connected apps and exfiltrate it via URL fetches.

original

Vendor digest: MicrosoftPart of the PlainSec briefing for 2026-08-18Every edition of this story: Microsoft Copilot Patch Lands Amid Scope DisputeMore from today

MLflow SSRF Is Already Harvesting Cloud Credentials

GitLab Exploitation Turns Repo History Into a Target

SAP Commerce Cloud Exploit Lands Days After Patch