Microsoft Patches Critical Copilot Vulnerability Allowing Silent Data Theft A critical flaw in Microsoft Copilot Personal, tracked as CVE-2026-24301 (CoSnitch), enabled attackers to exfiltrate sensitive data from connected accounts including Gmail, Google Drive, and Calendar with just a single click on a malicious link. Discovered by Varonis Threat Labs, the vulnerability was patched by Microsoft on August 18, 2026, though no evidence of active exploitation was found prior to the fix. CoSnitch exploited three interconnected weaknesses: 1. An undocumented URL parameter, combined with Copilot’s standard query function, allowed automatic execution of attacker-crafted prompts upon page load no user interaction required. 2. Once triggered, Copilot could query linked apps and funnel stolen data to an attacker-controlled server via its built-in URL-fetching feature, disguising the exfiltration as routine traffic. 3. A booby-trapped webpage could inject hidden instructions into Copilot’s persistent memory, surviving password resets, session revocations, and device re-enrollment rendering standard remediation ineffective. The discovery method itself was notable: Varonis researchers socially engineered Copilot’s reasoning by repeatedly questioning its security assumptions, prompting the AI to inadvertently reveal the exploit’s mechanics. This "meta-hacking" approach bypassed traditional code analysis, highlighting a new attack vector against AI systems. CoSnitch is the third Copilot vulnerability uncovered by Varonis in 2026, following Reprompt (which bypassed safety guardrails via repeated queries) and SearchLeak (which turned Copilot Enterprise into a covert exfiltration channel). All three exploits relied on single-click attacks, evading detection by mimicking legitimate assistant behavior. The incident underscores the risks of AI assistants with deep access to enterprise data, where a single compromised link can silently siphon large volumes of sensitive information. Security teams are advised to treat Copilot as a privileged insider, auditing connected apps and ensuring monitoring tools can detect anomalous AI-driven data access.

Microsoft 365 Copilot Bug Exposed Confidential Emails to AI Summarization A coding error in Microsoft 365 Copilot allowed its AI chat feature to process and summarize sensitive emails despite existing Data Loss Prevention (DLP) policies designed to block such access. The issue, tracked as CW1226324, affected the "work tab" in Copilot Chat, which assists users with summarizing content, drafting responses, and analyzing data across Outlook, Word, Excel, PowerPoint, and OneNote. Key Details: - Who: Microsoft 365 Copilot users, particularly enterprise customers. - What: A bug caused Copilot to read and summarize emails in Sent Items and Drafts folders, including those labeled as confidential or sensitive. - When: The issue emerged on January 21 and persisted until Microsoft began deploying a fix in early February. - Where: Impacted Outlook desktop users with Copilot enabled. - Why: The bug bypassed DLP policies, allowing AI processing of restricted content despite security labels. Impact: While Microsoft stated that no unauthorized access occurred users could only see content they were already permitted to view the incident raised concerns about AI integration with enterprise security. Potential risks included: - Legal or financial discussions being summarized outside intended controls. - HR communications exposed to automated analysis. - Undermined trust in AI-driven productivity tools. Microsoft’s Response: The company confirmed the issue, stating that a configuration update was rolled out globally to exclude protected content from Copilot access. However, Microsoft has not disclosed the number of affected organizations or a final remediation timeline. Broader Implications: The incident underscores the challenges of balancing AI utility with security. As AI assistants gain deeper access to sensitive data, even minor coding errors can create unexpected exposure, highlighting the need for rapid policy adaptation and transparency in AI deployments.

Microsoft Copilot Vulnerability Exposed: "Reprompt" Attack Bypasses Safety Mechanisms Researchers uncovered a method to exploit Microsoft Copilot’s URL parameter handling, enabling attackers to hijack user sessions and steal data without detection. Dubbed Reprompt, the attack leverages hidden malicious prompts embedded in seemingly legitimate Copilot links, which execute automatically upon loading requiring only a single click from the victim. Copilot, Microsoft’s AI assistant integrated into Windows, Edge, and consumer apps, connects to personal accounts, making it a prime target for session-based attacks. The vulnerability stemmed from Copilot’s auto-execution of prompts via the q URL parameter, allowing attackers to inject instructions into an authenticated session. Unlike traditional prompt injection attacks, Reprompt required no user input, plugins, or connectors, evading both user awareness and client-side monitoring tools. The attack’s simplicity lay in bypassing Copilot’s safeguards by instructing the AI to repeat actions twice. Once the initial prompt executed, attackers’ servers issued follow-up commands based on prior responses, creating an undetected chain of requests. This method obscured the attack’s true intent, making it difficult to trace. Microsoft patched the flaw in its January Patch Tuesday update, with no evidence of in-the-wild exploitation. However, the incident highlights persistent risks in AI assistants that process untrusted inputs such as URL parameters or external content without robust separation or filtering. While Copilot Personal lacked enterprise-grade protections, Microsoft 365 Copilot offers additional safeguards, including Purview auditing and data loss prevention (DLP) policies to block sensitive data exposure. The company is also testing policies allowing IT administrators to disable Copilot on managed devices, addressing concerns over unauthorized AI tool usage. The discovery underscores the ongoing challenges of securing AI-driven assistants against evolving exploitation techniques.