CoSnitch CVE-2026-24301: Copilot's hidden autorun stole emails
This title could be clearer and more informative.Try out Clickbait Shieldfor free (5 uses left this month).
Varonis Threat Labs disclosed CoSnitch (CVE-2026-24301), a chain of three vulnerabilities in Microsoft Copilot Personal. A crafted URL with a hidden `autorun=1` parameter let attackers trigger prompt execution with no user interaction beyond a click, exfiltrate data from connected OAuth apps (Gmail, Calendar, Drive), and plant persistent memory rules that survived password resets, session revocation, and device re-enrollment. Researchers found the undocumented parameter by repeatedly asking Copilot about its own constraints. Microsoft was notified in December 2025 and shipped a patch on August 18, 2026, the same day as public disclosure, an eight-month remediation window. No in-the-wild exploitation was confirmed before the patch. Users are advised to update Copilot, review memory rules and connected OAuth apps, and check account activity logs.
Table of contents
What is CoSnitch?How CVE-2026-24301 worked: three vulnerabilities chainedHow researchers found the hidden parameter: meta-hackingThe AI agent attack surface: what CoSnitch revealsMicrosoft had 8 monthsWhat was patchedWhat to check now?Questions this post answers
What is CVE-2026-24301 and how did the Copilot autorun exploit work?
CVE-2026-24301, dubbed CoSnitch, is a chain of three vulnerabilities in Microsoft Copilot Personal disclosed by Varonis Threat Labs on August 18, 2026. A crafted URL with the parameters `?q=<prompt>&autorun=1` made Copilot execute an attacker's prompt automatically on page load with no confirmation dialog, then exfiltrate data from connected OAuth apps and write persistent rules into Copilot's memory. Track AI agent vulnerability disclosures like this one to keep OAuth-connected tools locked down on daily.dev.
How did researchers discover the undocumented autorun=1 parameter in Microsoft Copilot?
Varonis Threat Labs used a meta-hacking technique, repeatedly asking Copilot why prompts couldn't auto-execute and what would technically enable it, rather than analyzing source code. After enough rounds of questioning, the model itself disclosed the undocumented `autorun=1` parameter along with a description of how it worked. Developers building on AI agents can follow emerging meta-hacking techniques on daily.dev.
How long did it take Microsoft to patch the Copilot CoSnitch vulnerability after disclosure?
Microsoft took roughly eight months to patch CVE-2026-24301 after Varonis notified them in December 2025, with the fix shipping August 18, 2026, the same day as public disclosure. This is far longer than the 60-90 day average time-to-patch across CVE categories reported by NVD data for 2025, and Microsoft has not explained the delay. Security teams weighing AI agent risk exposure can follow patch-timeline reporting like this on daily.dev.