A Microsoft Copilot bug let one click empty a user's inbox, calendar, and Drive

One click on a booby-trapped link was enough to empty a Microsoft Copilot Personal user's inbox, calendar, and cloud drive, silently and without a single confirmation prompt. Varonis Threat Labs disclosed the flaw, nicknamed CoSnitch and tracked as CVE-2026-24301, and Microsoft shipped a fix for it on August 18, 2026 — eight months after Varonis first reported it in December 2025. The U.S. National Vulnerability Database rates the bug 8.8 out of 10, its "high" severity tier, for a flaw that requires user interaction but no special privileges to trigger.

Copilot Personal is Microsoft's consumer assistant, distinct from the enterprise Microsoft 365 Copilot bundled into Office subscriptions — a distinction that matters here because neither Varonis nor the independent outlets that reviewed the research found evidence the enterprise product shared the same three flaws. What made CoSnitch dangerous wasn't a single hole; it was three ordinary-looking features that, chained together, add up to a working exfiltration pipeline running entirely inside normal-looking Copilot traffic.

The chain starts with a URL. Copilot Personal supported a `q=` parameter to pre-fill a prompt from a link and an undocumented `autorun=1` parameter that, combined with it, executed that prompt the moment the page loaded — no click on a "send" button, no confirmation dialog. From there, an injected prompt could query whatever the victim had already connected — Gmail, Google Calendar, Google Drive — using permissions the victim had granted long before, encode the results, and hand them to Copilot's own webpage-fetch tool to quietly deliver to an attacker's server. Because that final step looks identical to Copilot innocently fetching a page to summarize it, the exfiltration traffic is indistinguishable from ordinary Copilot use to anyone watching the network. The third flaw, a form of prompt injection, let a malicious webpage write its own instructions permanently into a victim's Copilot memory just by being summarized — instructions that persisted across sessions, logins, and even a password change, until someone found and deleted them by hand.

In testing, Varonis confirmed the chain could pull full email bodies (including anything a message had embedded, like credentials pasted into a support ticket), sender and recipient metadata, Calendar event titles and attendee lists, Google Drive filenames and metadata, and Copilot's own saved chat history — a fuller picture of a person's digital life than most single breaches expose, assembled from one link and zero further clicks.

The way Varonis found the bug is arguably the more interesting part of the story. Rather than reverse-engineering Copilot's code, researchers used what they call meta-hacking: they repeatedly asked Copilot to explain *why* a given automation was impossible, and treated each refusal as a technical disclosure. "We prompted Copilot to explain why auto-execution was impossible, and each refusal came with a technical justification, which mapped the architecture," Varonis wrote — and at one point, mid-refusal and unprompted, Copilot named the undocumented `autorun` parameter itself, along with its history and the protections meant to disable it.

“Copilot wasn’t breached; it was played.” — Varonis Threat Labs, on how CoSnitch was found

That is a genuinely different discovery method than the exploit-hunting security research has run on for decades, and it works precisely because a conversational assistant will, by design, try to be helpful about explaining itself. (The same trait that makes Copilot good at troubleshooting your printer driver is what let researchers troubleshoot Copilot's own security model — the assistant had no way to know the person asking "why can't this run automatically" wasn't a legitimate developer.) As more products wrap a chat interface around access to a user's real accounts, an assistant that answers technical questions about its own guardrails is handing out a debugging tool to anyone patient enough to keep asking.

Microsoft's patch and NVD's published record both land on the same bottom line Varonis reported: no evidence CoSnitch was ever used against a real account. That is Varonis's own finding from its testing and disclosure process, not an independent audit of Microsoft's logs — a real difference, and one worth holding onto rather than reading as a clean bill of health. What CoSnitch actually demonstrates is a threat model that has come up before on this desk in Claude Cowork's own sandbox-escape disclosure this summer: an assistant with real account access is only as safe as the narrowest of its own features, and prompt injection — instructions smuggled in through content the assistant reads rather than typed by the user — is now the recurring shape these failures take across more than one company's product.