“CoSnitch” Vulnerability Let Attackers Trick Microsoft Copilot Into Silently Exfiltrating User Data

For the third time this year, security researchers with Varonis have found a way to talk Microsoft Copilot into betraying its users and furnishing an attacker with their private data.

The new “CoSnitch” attack they have documented was patched out before the public reveal, but apparently was workable since at least December of last year. The researchers mention no evidence of it being exploited in the wild, but of course the absence of evidence never equates to the evidence of absence in these cases. This combined with other recent incidents at Microsoft has raised questions about the overall security of the AI, office suite and operating system that much of the government and business world relies on for daily operations.

CVE for Microsoft Copilot issued, but “CoSnitch” was patched prior to it

The CVE is CVE-2026-24301 (severity 8.8) and, to hear Microsoft tell it, not something anyone has to worry about at this point (minus disruption of some third-party browser extensions that have apparently also been fixed at this point). It also only impacted the Microsoft Copilot Personal, not the 365 edition more common to offices and workplaces.

Still, there is cause for concern with the vulnerability window stretching back at least eight months, and quite possibly throughout the whole public lifespan of Microsoft Copilot. The researchers also demonstrated that data exfiltrated via the malicious prompt could be fairly trivially hidden from network defenses in base64, appearing to be just another normal fetch request for the typical summaries of webpages Copilot generates for users.

The presence of other similar bugs in Microsoft Copilot, which involved no real hacking and were only a matter of “smooth talking” the AI into granting access, heightens the general level of concern. As mentioned, Varonis has already found two similar in the past year (along with one in Atlassian’s Rovo and in Reprompt). Microsoft themselves also issued a warning and guidance about this very type of attack in June of this year, but did not cover all of the methods and techniques the researchers used.

How safe is Microsoft Copilot?

In addition to the fact that simply bamboozling the LLM with requests was all that was necessary, it’s important to note the scope of data this granted access to: essentially, anything connected to Microsoft Copilot as part of a workflow as well as its own internal memory. What the targeted user would have access to when using Copilot is also what the attacker would have access to, but with the ability to move and exfiltrate invisibly in the background.

As to how the attackers manipulated Microsoft Copilot, they simply asked the AI to provide technical reasons for why it couldn’t do something. In this case, they started by asking it why a prompt can’t be automated and continued from there until hitting upon disclosure of a combination of URL elements that would disable Copilot’s safety restrictions in this area. This allowed for a malicious prompt to be run automatically when the user visits a URL it is embedded in.

The most concerning element is OAuth connections. In the researcher’s examples, this granted access to connected Google accounts (meaning Gmail, Drive, Calendar and such in turn). Microsoft Copilot could also be leveraged to silently rifle through both a Gmail account and its own memory for mentions of authentication credentials or internal/classified information.

The final concerning element is the payload delivery. Since the malicious prompt is seen by the LLM as legitimate, it can be sent to a victim from the Microsoft Copilot domain (which might inspire a sense of trust to someone otherwise being reasonably vigilant for odd domain names in links). All the victim has to do is click through the link and the damage is done, even closing out Copilot early will not stop whatever malicious instructions were bundled from being executed.

So does this mean Microsoft Copilot, or any other similar AI, is unsafe to use? The researchers at least do not feel the danger is at that drastic a level as of yet. This specific sort of attack can be curtailed or at least limited with careful monitoring and regular auditing of what the AI has access to without a human OK, and network monitoring can also be tweaked to better pick up AI agents engaging in anomalous patterns of this type.