Microsoft Copilot Personal Flaws Could Let One Click Exfiltrate Data From Connected Apps
- ID
- 15337
- Status
- summarized
- Published
- 19 Aug 2026, 1:47 AM
- Fetched
- 19 Aug 2026, 4:05 AM
- Provider
- The Hacker News
- Category
- security
- Original URL
- https://thehackernews.com/2026/08/microsoft-copilot-personal-flaws-could.html
- Source URL
- https://feeds.feedburner.com/TheHackersNews
Summary
- Score
- 7.0
- Created
- 19 Aug 2026, 4:06 AM
- Tags
- Audience
- developersai_agent_usersai_ml_learners
What happened
Varonis Threat Labs disclosed three vulnerabilities in Microsoft Copilot Personal (the consumer assistant at copilot.microsoft.com), collectively named CoSnitch (CVE-2026-24301), that allowed a single click on a crafted link to silently exfiltrate data from connected apps. The attack hinges on an undocumented `autorun=1` URL parameter that Copilot itself revealed when researchers repeatedly asked it why a prompt couldn't execute without user interaction—an approach Varonis calls 'meta-hacking.' Patches shipped August 18, 2026; no evidence of in-the-wild exploitation, and Microsoft 365 Copilot is not stated to be affected.
Why it matters
If you build AI agents or assistants that accept prompts via URL parameters, connect to external apps, or auto-execute on page load, this is a concrete blueprint for how that surface gets abused: an attacker-crafted URL can fire a prompt in the victim's authenticated session and run to completion even if they close the tab. Audit whether your own agent has any equivalent of an `autorun`-style parameter or a `q`-style pre-fill that, combined, could trigger unattended execution against connected data sources.
Discussion angle
The 'meta-hacking' technique—getting the AI assistant to explain its own security boundaries until it names the parameter that bypasses them—is a pattern worth discussing for anyone building or red-teaming AI agents. What guardrails prevent your own agent from leaking its internal parameters or attack surface when probed this way?