Microsoft's Copilot Personal had a bug that let one clicked link hand an attacker your Gmail, Google Drive files, calendar and whatever lives in your OneDrive. The researchers who found it needed one more piece to prove it worked, an undocumented parameter Microsoft never published. They got it from Copilot itself, by asking the assistant why the attack shouldn't be possible. Its answer contained the exact thing it was supposed to be hiding.

  • CVE-2026-24301, nicknamed CoSnitch, let a single click trigger a prompt injection inside Copilot Personal that queried connected Gmail, Drive, Calendar and OneDrive accounts and shipped results out through Copilot's own URL-fetch feature.
  • Varonis researcher Lior Adar found the missing exploit detail by reading Copilot's own explanation of why the attack should fail, a technique Varonis calls meta-hacking.
  • Microsoft received the report in December 2025 and shipped a fix on August 18, 2026, roughly eight months later, for a critical, one-click, data-theft bug in its flagship AI product.
  • Varonis found no evidence CoSnitch was exploited before the patch, but the ingredients behind it, untrusted input, private data access and an outbound channel, are structural to how assistants like Copilot work.

Copilot's own guardrails gave up the exploit

Here is the part worth sitting with. Adar's team suspected Copilot Personal could be coaxed into reading a victim's connected accounts through a crafted prompt, but an early attempt didn't fire. Rather than reverse-engineer the block from scratch, Varonis asked Copilot directly why the request had failed. Copilot, trying to demonstrate the attack was infeasible, walked through its own reasoning, and somewhere in that explanation sat the undocumented parameter that made the attack work. The assistant built to refuse the exploit ended up narrating the fix.

RelatedThree FortiSandbox CVEs Hit by AI-Generated Exploits

That's not a one-off quirk, it's a design property. A model that can explain its own refusals is functionally an oracle for probing its own defenses. Ask a firewall why it blocked a packet and you get a log line. Ask a language model and you get a paragraph of reasoning, often with specifics about what would have worked. Refusal-with-explanation is a UX feature for the honest user and a probing tool for anyone willing to keep asking why.

What actually happens when you click?

Three hops. First, the attacker gets a prompt in front of Copilot, embedded somewhere it will read, behind that one link. Second, once the prompt executes, it instructs Copilot to query whatever accounts the victim has connected: Gmail, Drive, Calendar, OneDrive. Third, the results need to leave the system, and CoSnitch used Copilot's own URL-fetch capability to send them to an attacker-controlled webhook. No malware, no separate exfiltration tooling. The assistant does the stealing with tools it already had.

CoSnitch attack chain, from malicious link to attacker webhook A six step left to right flow. A malicious link is crafted by the attacker, the victim clicks it, an injected prompt executes inside Copilot, Copilot queries the victim's connected Gmail, Drive, Calendar and OneDrive accounts, Copilot's own URL fetch feature sends the data out, and it lands on an attacker controlled webhook. Steps under attacker control are highlighted in orange. ATTACK CHAIN: COSNITCH One click, six steps, one webhook 010203040506 Malicious link attacker crafted Victim clicks one click only Prompt executes runs in Copilot Queries accounts Gmail, Drive, Cal, OneDrive URL fetch Copilot's own feature Attacker webhook leaves Microsoft genztech.blog
Fig 1 The full CoSnitch chain runs on Copilot's own capabilities. Steps in orange are under attacker control, no separate malware needed.

Every hop after the click uses tools Copilot already has permission to use. Nothing looks like malware because nothing is malware, which is what makes this exploit class hard to catch.

Why did a critical bug take eight months to fix?

Varonis reported CoSnitch in December 2025. Microsoft shipped the patch on Tuesday, August 18, 2026. Computerworld and CSO Online both flagged the gap as unusually long for a critical, one-click vulnerability in a product Microsoft is actively pushing into email, files and calendars for hundreds of millions of users. Microsoft hasn't published a detailed account of why the fix took that long, and the MSRC advisory lists the patch without a timeline explanation.

An eight-month window isn't academic. It's the stretch where a defender has to assume the flaw is live even without proof of exploitation, since proof usually arrives after the damage, not before. Varonis found no evidence CoSnitch was exploited in the wild, which is good news, but "no evidence found" over eight months is a statement about what researchers could see, not a guarantee of what attackers did.

RelatedBlueHammer Defender Zero-Day Hit SYSTEM in the Wild

  1. Dec 2025Varonis reports CoSnitch to Microsoft Lior Adar documents the chain, including the meta-hacking discovery of the missing parameter
  2. Jan to Jul 2026Patch development window no public disclosure; Microsoft has not detailed the delay
  3. 2026-08-18Microsoft ships the fix roughly eight months after the initial report
  4. NowAdvisory published MSRC advisory for CVE-2026-24301 goes live alongside Varonis's writeup
  5. OngoingWatch for copycat research the meta-hacking method is public now, expect it aimed at other assistants

The exfiltration primitive is the feature set

Strip away the branding and CoSnitch is the same triad behind almost every serious prompt injection case: untrusted input reaches the model, the model has access to private data, and the model has a way to send something back out. What makes assistants like Copilot different is that the third leg, the outbound channel, isn't a bug sitting in some forgotten endpoint. It's URL fetch, a capability Copilot needs to do useful work like checking a link for you. You can't patch away the feature without breaking the product, and fetching a URL to help you looks identical to fetching a URL to leak your calendar unless something is watching what a request is allowed to touch and where it's allowed to go.

What actually helps: egress allowlisting on any fetch the assistant initiates on its own, so an AI-triggered request can only reach a small, known set of destinations rather than an arbitrary webhook. Treating each connected account, Gmail, Drive, Calendar, OneDrive, as its own blast radius rather than one pool of "connected apps," so a compromise in one scope doesn't grant read access across all of them. And a human confirmation step for any action that crosses connector boundaries, so a read from one service and a send to another doesn't complete silently. None of that is exotic, it's the same segmentation logic security teams already apply to service accounts, applied to an assistant that now behaves like one.

Our take

The meta-hacking angle is the real story here, more than the patch timeline. Every major AI vendor is racing to make assistants explain themselves better: more transparency, more visible reasoning, more "here's why I did or didn't do that." That's generally good for trust. But CoSnitch shows the tradeoff nobody's pricing in yet. An assistant that reasons out loud about its own guardrails is handing attackers a debugger. Varonis didn't need to fuzz Copilot's defenses for weeks, they asked it a question and it told them the answer. As these systems get better at self-explanation, that leak surface grows unless someone walls off "explain your safety reasoning" from "reveal the parameter that would defeat it." Nothing in the industry treats those as different problems yet.

What to watch
  • Other Copilot connectors. CoSnitch touched Gmail, Drive, Calendar and OneDrive. Any other linked service inherits the same blast-radius question until Microsoft details the fix further.
  • Meta-hacking against other assistants. Asking a model to explain its own refusal isn't Copilot-specific. Expect researchers to try it against Gemini, ChatGPT connectors and enterprise copilots.
  • Microsoft's disclosure timeline. An eight-month gap on a no-interaction-needed bug is worth tracking against how Microsoft handles the next Copilot report.
  • Your own connector scopes. If you use Copilot Personal, check which accounts are connected and whether all of them need to be linked at once.
Primary sources

Original analysis by GenZTech. Facts and dates drawn from Varonis's disclosure, Microsoft's MSRC advisory for CVE-2026-24301, and reporting from Computerworld, CSO Online and Cybernews, linked above.