Vulnerabilities · 55 days ago

Microsoft Copilot Patch Lands Amid Scope Dispute

Microsoft patched CoSnitch, CVE-2026-24301, in Copilot on August 18 after Varonis said it found an undocumented `autorun=1` parameter that let a crafted link run a prompt without a visible approval step. The reporting now splits on scope: Microsoft says only Copilot Personal was affected, while Ars Technica describes the exploit against Microsoft 365 Copilot Enterprise.

The trick was to ask Copilot why auto-run was blocked until it disclosed the hidden switch, then pair that parameter with the normal `q` field so the prompt fired as soon as the page loaded. In Varonis’ account, that could pull data from connected services and send it out through Copilot’s own URL-fetch behavior, all inside the user’s authenticated session.

That leaves the blast radius unresolved in public reporting, which matters for anyone treating Copilot as a cleanly segmented consumer or enterprise control. Even with Microsoft’s patch, the trust boundary is the story: a link can still become an execution path if your assistant can read connected apps and honor URL-driven input.

CVE-2026-24301

NVD KEV

CVSS 8.8 HIGH: improper neutralization of special elements used in a command ('command injection') in Microsoft Copilot allows an…

Timeline

Aug 19 Reported by CSO Online

Sources

4 sources covering this story

CSO Online Aug 19
Microsoft finally patches critical one-click Copilot vulnerability, almost eight months after learning of it
Dubbed CoSnitch by the security researcher who discovered it, the flaw executes an attack chain that exfiltrates data from enterprises without any obvious red flags.
Dark Reading Aug 18
'CoSnitch' Attack Tricked Copilot Into Revealing Own Architecture
Researchers discovered a "meta-hacking" technique that can manipulate the AI service into revealing its own security weaknesses.
The Hacker News Aug 18
Microsoft Copilot Personal Flaws Could Let One Click Exfiltrate Data From Connected Apps
CVE-2026-24301 lets crafted Copilot Personal links auto-run prompts that can pull data from connected apps and exfiltrate it via URL fetches.
Ars Technica Security Aug 18
Microsoft Copilot reveals secret input that allowed it to be hacked
Secret parameter allowed hackers to steal passwords when a target clicked on a link.

Entities

CVE-2026-24301

Vendor digest: Microsoft

Part of the PlainSec briefing for 2026-08-18

Editions

Briefing for 2026-08-18

Vulnerabilities · 55 days agoMicrosoft Copilot Patch Lands Amid Scope DisputeMicrosoft patched CoSnitch, CVE-2026-24301, in Copilot on August 18 after Varonis said it found an undocumented `autorun=1` parameter that let a crafted link run a prompt without a visible approval step. The reporting now splits on scope: Microsoft says only Copilot Personal was affected, while Ars Technica describes the exploit against Microsoft 365 Copilot Enterprise.The trick was to ask Copilot why auto-run was blocked until it disclosed the hidden switch, then pair that parameter with the normal `q` field so the prompt fired as soon as the page loaded. In Varonis’ account, that could pull data from connected services and send it out through Copilot’s own URL-fetch behavior, all inside the user’s authenticated session.That leaves the blast radius unresolved in public reporting, which matters for anyone treating Copilot as a cleanly segmented consumer or enterprise control. Even with Microsoft’s patch, the trust boundary is the story: a link can still become an execution path if your assistant can read connected apps and honor URL-driven input.

CVE-2026-24301

NVD KEV

CVSS 8.8 HIGH: improper neutralization of special elements used in a command ('command injection') in Microsoft Copilot allows an…

Timeline

Aug 19 Reported by CSO Online

Sources4 sources covering this story

CSO Online Aug 19

Microsoft finally patches critical one-click Copilot vulnerability, almost eight months after learning of it

Dubbed CoSnitch by the security researcher who discovered it, the flaw executes an attack chain that exfiltrates data from enterprises without any obvious red flags.