On August 18, 2026, Microsoft shipped a server-side fix for a flaw in Microsoft Copilot Personal that Varonis Threat Labs calls CoSnitch. Microsoft assigned it CVE-2026-24301, classified it as an information-disclosure issue, and rated it 8.8 under CVSS 3.1. Varonis had reported it to Microsoft in December 2025; the two companies confirm the patch went out roughly eight months later, on August 18. Varonis says it found no evidence the flaw was exploited in the wild before the fix.
CoSnitch is not one bug but three, chained. First, an undocumented URL parameter: the ordinary ?q= parameter pre-fills a prompt, but pairing it with autorun=1 caused the prompt to execute the instant the page loaded — no click, no confirmation, no user gesture. Second, exfiltration through Copilot's own capabilities: an auto-executed prompt could query the victim's connected apps — Gmail, Drive, Calendar — encode the results, and ship them to an attacker's webhook using Copilot's built-in URL-fetch, a request Varonis says is indistinguishable at the network layer from any page Copilot legitimately summarizes. Third, persistent memory poisoning: a booby-trapped webpage, once summarized, could write attacker instructions into Copilot's cross-session memory store. Varonis characterizes that write as surviving password changes, session revocation and device re-enrollment. Varonis also documented how it found the flaw — a technique it calls "meta-hacking," in which it socially engineered Copilot into disclosing its own undocumented autorun parameter mid-refusal, while explaining why the attack was supposedly impossible.
Why does the same failure keep landing on AI assistants?
Strip away the novelty and the root cause is one Varonis names directly: Copilot "does not distinguish between content to summarize and instructions to follow" when it processes external content. That single design property — no hard boundary between data and instructions — is what makes indirect prompt injection possible, and it is not specific to Microsoft. Varonis's Lior Adar told Dark Reading the pattern of "broad data access, assumed user intent, and a lack of separation between instructions and data continues to pop up across various vendors and products."
The second structural fact is the connector model. When a user links Gmail or Drive to an assistant, they grant an OAuth token scoped to real permissions, and the assistant can invoke it during a conversation. The system's load-bearing assumption is that those invocations are user-initiated. CoSnitch broke that assumption: auto-execution meant a connector could fire without the user ever typing anything. The assistant did exactly what it was designed to do — read the user's authorized data — on behalf of an instruction the user never gave.
Adar's framing is the one worth keeping: "Every enterprise AI assistant is a privileged insider with no security awareness." A tool with standing access to mail, files and calendar, that acts on whatever text reaches its context, is an insider account — and in his words you should "assume the trust boundary between legitimate and injected prompts will be broken."
Why a "personal" flaw is an enterprise problem
Microsoft told Dark Reading that enterprise customers are unaffected and no customer action is required, because CoSnitch touched only Copilot Personal. That scoping is accurate and worth stating plainly. But it is also where the security lesson lives rather than where it ends.
Adar's own account explains why: "The person using Copilot Personal is the same person who walks into your office Monday morning." Corporate mail forwarded to a personal inbox, credentials pasted into a personal account, work documents in a personal Drive — when a personal assistant is compromised, the data it reaches is often enterprise data. A password lifted from a personal inbox becomes a foothold in a corporate tenant. The blast radius of a consumer tool is drawn by what the employee connected to it, not by the vendor's license tier.
What should security teams check now?
Varonis's recommendations are concrete and vendor-agnostic. Audit connector configurations — review which apps are linked to any AI assistant and whether each connection is still necessary, because fewer connections mean a smaller blast radius. Treat the assistant as a privileged insider — apply the same access review and anomaly detection you would to a human employee with broad data access. Scrutinize link delivery — the chain requires a click, so links that open AI tools with a pre-filled prompt deserve a second look before they run. And verify monitoring coverage — confirm whether your current tooling would even detect unusual data access originating from an AI assistant, because, as Varonis puts it, most tools have a blind spot there.
There is a prior question underneath all four: do you know which AI assistants your people are running, and against which providers, in the first place? A connector audit assumes you have an inventory. Most organizations do not.
How Waxell handles this
The precondition CoSnitch exploited — a consumer AI assistant, connected to work data, invisible to the security team — is exactly the gap Waxell Endpoints exists to close. Endpoints discovers the AI apps running on employee machines, per device and per user, and Copilot, ChatGPT, Claude Desktop and browser assistants are among the tools in its catalog. The unknown inventory becomes a known one on the day the agent is installed.
Endpoints attributes outbound AI traffic by reading the plaintext hostname in the TLS handshake — which process, which provider host, when — without decrypting anything. Under policy, an app can be left observe-only, blocked at the network layer before data leaves the machine, or, only when an admin explicitly turns it on, captured with secrets and PII redacted on the device. Waxell cites an average of $670,000 added to breach costs specifically from shadow AI, on a fleet most teams currently cannot see, and its catalog spans 60+ AI provider domains.
Two honest limits matter here, because the incident sits partly outside what any device-level tool observes. CoSnitch's exfiltration webhook and its memory write happen inside Microsoft's cloud, not on the laptop — Endpoints reads the connection to the provider by hostname, not the prompt Copilot runs or the memory it stores. So Endpoints is not a prompt-injection scanner and does not inspect what an assistant does server-side. What it does is answer the question the CoSnitch story starts with: is this personal AI assistant talking to a model provider from a corporate machine at all, and do you want it to? That decision — inventory, attribution, and a network-layer block if you choose it — is the first control, and it is the one most fleets are missing.
FAQ
What is CoSnitch, and how serious is it?
CoSnitch is the name Varonis Threat Labs gave to a chain of three vulnerabilities in Microsoft Copilot Personal, tracked as CVE-2026-24301 and rated 8.8 under CVSS 3.1 by Microsoft. Chained, they let a single crafted link auto-execute an attacker's prompt and exfiltrate data from the victim's connected apps. Microsoft shipped a server-side fix on August 18, 2026.
Were enterprise Copilot customers affected?
Microsoft told Dark Reading that enterprise customers are unaffected and no customer action is required, because the flaw was in Copilot Personal. The caveat from the researcher is that personal accounts are frequently connected to corporate data — forwarded mail, shared credentials, work files — so a personal-tool compromise can still reach enterprise information.
What is "meta-hacking"?
It is the discovery method Varonis used: rather than reverse-engineering Copilot, its researchers asked Copilot to explain why automatic prompt execution was impossible, and each refusal disclosed more of the architecture, until Copilot named the undocumented autorun parameter itself. Varonis describes it as social-engineering the reasoning engine, and says the technique applies to any agentic platform with a natural-language interface.
Was CoSnitch exploited in the wild?
Varonis says it found no evidence the attack was used against real victims before Microsoft's patch. The disclosure was coordinated: reported December 2025, fixed August 18, 2026.
Would Waxell have stopped this attack?
No — and it is worth being precise about why. The exfiltration and the memory write in CoSnitch happen inside Microsoft's cloud, not on the device, so a device-level tool does not see the prompt or the webhook. Waxell Endpoints addresses the precondition, not the exploit: it discovers which personal AI assistants are running on your fleet, attributes their provider traffic by hostname, and can block an app at the network layer under policy. It is inventory and control, not prompt-injection defense.
How do I even know which AI assistants my team uses?
That is the discovery problem Endpoints is built for. A signed agent, deployable through MDM or by manual install, scans each machine and reports every AI app it finds, matched against a catalog of AI provider domains. Apps talking to a provider not yet in the catalog surface as ungoverned rather than staying invisible.
Sources
- Varonis Threat Labs (Lior Adar), "CoSnitch: When Your AI Assistant Becomes Its Own Whistleblower" — updated August 18, 2026
- Dark Reading (Alexander Culafi), "'CoSnitch' Attack Tricked Copilot Into Mapping Out Architecture" — August 18, 2026
- The Hacker News, "Microsoft Copilot Personal Flaws Could Let One Click Exfiltrate Data From Connected Apps" — August 2026
Originally published on the Waxell blog.
Your team's personal AI assistants are already connected to work data — the question is whether you can see them. Waxell Endpoints discovers the AI running on every managed machine, attributes its traffic by provider, and blocks what you decide shouldn't be there. Map the shadow AI on your fleet.
