Varonis Threat Labs found a critical Microsoft Copilot Personal flaw that let one click on a crafted link silently pull a victim's email, files and calendar data, the company said. Microsoft patched the flaw, tracked as CVE-2026-24301 and nicknamed CoSnitch, on August 18.
The attack chained three separate flaws, including an undocumented "autorun=1" URL parameter that, combined with Copilot's query parameter, caused an embedded prompt to execute automatically without user confirmation, Varonis and The Register reported. Once triggered, the exploit could reach connected accounts including Gmail, Google Drive and Google Calendar, plus Copilot's own memory, within the victim's authenticated session, according to Varonis.
Varonis said it found the flaw through a technique it calls "meta-hacking," repeatedly asking Copilot why automatic prompt execution should be impossible until the assistant's answers revealed the undocumented parameter researchers then exploited. "Copilot wasn't breached; it was played. What it revealed set the stage for the entire CoSnitch chain," Varonis researchers wrote.
Varonis reported the issue to Microsoft in December 2025 and said it found no evidence the flaw was exploited before the patch shipped, according to the company and The Register. Senior security researcher Lior Adar said the flaw "highlights deep architectural flaws that can carry over directly into corporate environments."
The notable part for builders is the discovery method: an assistant argued its way into disclosing its own attack surface when pushed on a technical claim. Any product that lets a model explain its own guardrails in detail should assume an attacker will use that same conversation to map them.