- Status: Patched
- CVE: CVE-2026-24301
- Affected Versions: Personal Microsoft Copilot
- Reported: December 31, 2025
- Partial Fix: February 1, 2026
- Full Patch: Tuesday (Current)
Microsoft has finally issued a comprehensive patch for the CoSnitch vulnerability, a critical security flaw in its personal Copilot AI assistant that was first disclosed by cybersecurity firm Varonis more than eight months ago. The vulnerability, labeled as “critical” by Microsoft’s Security Response Center (MSRC) under CVE-2026-24301, allowed attackers to execute malicious prompts with a single click, exfiltrate sensitive data from connected apps, and permanently poison the AI’s memory store.
The delay between the initial disclosure and the full remediation has drawn scrutiny, highlighting the complex tension between shipping AI features and securing them. Varonis senior security researcher Lior Adar noted that while a partial patch issued on February 1 significantly lowered the risk, it did not fully close the exploit chain until Tuesday’s update.
What is the CoSnitch Vulnerability?
The CoSnitch flaw is notable for chaining three distinct Copilot weaknesses into a single, devastating attack vector. According to a detailed blog post published by Varonis on Tuesday, the exploit relies on the fundamental inability of large language models (LLMs) to distinguish between data inputs and executable instructions.
The first component involves automatic prompt execution. Varonis discovered that a specific URL parameter, combined with an undocumented parameter, could force Copilot to execute an attacker-supplied prompt instantly upon page load. This required no user click, confirmation, or interaction, making it a silent and immediate threat.
The second component enables data exfiltration to external servers. Once the prompt is executed, it can query the victim’s connected applications, such as Gmail, Google Drive, Calendar, or OneDrive. The results are then encoded into a URL and sent to an attacker-controlled webhook via Copilot’s built-in URL-fetching capability.
The third and most persistent element is persistent memory poisoning through web summarization. A crafted webpage, when summarized by Copilot, injects attacker instructions into the victim’s permanent memory store. Crucially, this injection survives password changes, session revocation, and device re-enrollment, effectively persisting indefinitely.
How the Flaw Was Discovered
The discovery of CoSnitch is as intriguing as the flaw itself. Varonis researchers found that they could essentially trick Copilot into revealing its own security architecture. By prompting the AI to explain why auto-execution was impossible, they received technical justifications that mapped the underlying system.
Varonis then reframed every refusal as a follow-up question, narrowing the attack surface with each answer. During this process, Copilot disclosed an undocumented URL parameter, unprompted, mid-refusal, including its historical behavior and every protection put in place to disable it. The researchers built the URL exactly as described, and with no user action required, the prompt was successfully executed automatically.
“Copilot wasn’t breached; it was played,” Varonis stated in their report. This methodology highlights a sophisticated combination of social engineering on an LLM, jailbreaks, and prompt injection, all working in tandem.
The Eight-Month Patch Delay
The timeline for addressing CoSnitch reveals the challenges Microsoft faces in securing AI products. Varonis reported the flaw on December 31, and while a partial fix was deployed on February 1, the complete remediation took until Tuesday to finalize. This eight-month window suggests a negotiation between Microsoft’s security obligations and its product roadmap.
Aman Mahapatra, chief strategy officer at Tribeca Softtech, argued that the financial incentives for major AI companies make meaningfully fixing these holes nearly impossible. He pointed out that every guardrail that would fully close this class of attack degrades the product, as the same capabilities being exploited are the features Microsoft markets as Copilot’s value proposition.
“The fix and the feature are in direct tension, which means these will not be cleanly patched so much as perpetually mitigated,” Mahapatra said. “The eight-month window is what it looks like when a vendor is negotiating between its security obligation and its product roadmap on every single fix.”
Enterprise Implications and Copilot Fusion
Microsoft’s initial statement claimed that enterprise customers using Microsoft 365 Copilot were not affected. However, analysts and security experts have pushed back on this assertion. The complex nature of enterprise environments often includes consumer-grade Copilot instances from personal accounts used by workforce members, meaning the flaw in the personal version could absolutely impact the enterprise version.
This concern is further complicated by Microsoft’s plans to merge personal and enterprise Copilot experiences into a unified offering known as “Copilot Fusion.” Details of this planned product merger began to leak last month, indicating that enterprise CISOs need to be concerned about flaws in the personal version that may be carried over into the merged offering.
Mark Tauschek, VP and distinguished analyst at Info-Tech Research Group, emphasized the severity of the memory-poisoning component. He noted that a single summarized webpage can write attacker instructions into Copilot’s persistent memory, which survives all standard incident response steps. This means the attacker needs no persistent infrastructure after the initial write, as every future session runs under attacker-controlled context.
What This Means for You
For everyday users, the CoSnitch vulnerability underscores the risks of integrating AI assistants with personal data. The ability to exfiltrate data from Gmail, Drive, and OneDrive with a single click is a significant privacy concern. Additionally, the persistent memory poisoning means that even after removing the initial trigger, the AI could continue to act on attacker instructions.
Users should be aware that the “one-click” nature of the exploit means that legitimate-looking links could be dangerous. The delay in patching also suggests that similar vulnerabilities may exist in other AI products, as the same architectural limitations apply.
How to Stay Safe
Microsoft has confirmed that customers are already protected and do not need to take any action, as the patch has been deployed. However, given the nature of the flaw, users should remain vigilant.
1. Update Copilot: Ensure your Copilot application is updated to the latest version to receive the full patch.
2. Monitor Memory Settings: Regularly review Copilot’s persistent memory settings. Be cautious of web pages being summarized, as this could be an attack vector.
3. Be Wary of Links: Avoid clicking on suspicious links, even if they appear legitimate. The exploit requires no confirmation, so caution is essential.
4. Review Connected Apps: Periodically review which apps are connected to Copilot. Disconnect any services you no longer use to reduce the attack surface.
Flavio Villanustre, CISO for the LexisNexis Risk Solutions Group, pointed to a bigger-picture issue impacting all agentic and genAI deployments. He stated that the mechanisms behind prompt injection are based on the inability of LLMs to differentiate between data and instructions. “This is another example of why a different architectural approach to LLMs that separates data and instructions is needed to better guarantee the safety of their operation,” he said. “This is not something that Microsoft or any other AI vendor has addressed to date.”
As AI assistants become more integrated into our digital lives, the CoSnitch vulnerability serves as a stark reminder of the security challenges that lie ahead. The eight-month delay in patching highlights the ongoing struggle to balance innovation with safety, a challenge that will only grow as these technologies evolve.
Source: Computerworld
Over to you: Have you reviewed your Copilot memory settings recently, or do you rely on the default configurations?
