Security researchers at Varonis Threat Labs disclosed three vulnerabilities in Microsoft Copilot Personal — the consumer assistant at copilot.microsoft.com — that they collectively named CoSnitch. A single click on a crafted link was enough to silently run a Copilot prompt and exfiltrate data from whatever apps the victim had connected to the assistant, including email, calendar, and cloud storage. The attack worked because of an undocumented URL parameter, autorun=1, that Varonis discovered by repeatedly asking Copilot itself to explain why a certain prompt required user interaction — the AI helpfully described the exact mechanism needed to bypass the requirement. When the researchers built the URL exactly as described, the parameter Copilot had explained was off-limits executed without any user gesture at all. Copilot “wasn’t breached; it was played,” Varonis wrote.
The attack URL pairs autorun=1 with the standard q parameter. Together they cause Copilot to fire the injected prompt the moment the page loads, even if the victim immediately closes the tab. The three vulnerabilities are tracked under CVE-2026-24301. Varonis reported the issue to Microsoft in December 2025; Microsoft patched it on August 18, 2026. The researchers found no evidence of exploitation in the wild before the patch shipped, and the fix is server-side — Copilot Personal runs as a web service, so users don’t need to install anything.