Microsoft Copilot Personal Flaws Could Let One Click Exfiltrate Data From Connected Apps

Summary: Varonis Threat Labs disclosed three vulnerabilities in Microsoft Copilot Personal, collectively named CoSnitch and tracked as CVE-2026-24301, that it said could let a single click on a crafted link pull data from connected apps into the victim's session. The researchers said they reported the issue to Microsoft in December 2025 and that patches shipped on August 18, 2026, and found no evidence of exploitation in the wild.
What you should know: The researchers said the exfiltration request is indistinguishable at the network layer from Copilot's ordinary web-page fetches, and that an injected memory survives password changes, session revocation, and device re-enrollment until the user deletes it from Copilot's memory settings.

Read the original at The Hacker News ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2026-24301
Related: ⚡ Weekly Recap: AI-Powered PLC Attacks, Git Lab Attacks, Stripe Key Leaks and More Cyber Risks ·
Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026