Microsoft Copilot CoSnitch: Could One Link Steal Gmail And Chat History?

August 20, 2026

Before Microsoft patched CoSnitch, Varonis says one crafted Copilot Personal link could run a prompt, reach connected data, and send results outward.

Yes—before Microsoft patched it on August 18, 2026, Varonis Threat Labs says a crafted link could make Microsoft Copilot Personal run an attacker-supplied prompt inside a signed-in user's session, retrieve data from authorized sources, and send results to an external server without a second confirmation. The researchers called the three-part chain CoSnitch.

The qualification matters: the victim still had to open the crafted link, Copilot needed access to useful data, and the public evidence comes from controlled research rather than a confirmed breach. Microsoft says customers are already protected, no action is required, and enterprise Copilot was not affected by this issue. Varonis says it found no evidence of exploitation in the wild.

CoSnitch is still a useful warning. When an AI assistant can read email, files, calendars, prior chats, and persistent memory, the key security question is not only whether each connection was authorized. It is also what can invoke that already-authorized access, what needs a fresh approval, and where retrieved data can go.

What Is Confirmed

Varonis published its CoSnitch disclosure on August 18, 2026 after a coordinated disclosure to Microsoft in December 2025. The researchers describe three vulnerabilities in Microsoft Copilot Personal:

A crafted Copilot URL could combine a prompt parameter with an undocumented auto-run parameter so the prompt executed when the page loaded.
The injected prompt could retrieve data through Copilot's authorized sources and use Copilot's web-fetch behavior to send encoded results to an attacker-controlled endpoint.
A malicious page submitted for summarization could place attacker-selected instructions into Copilot's persistent memory.

Microsoft assigned CVE-2026-24301 to an information-disclosure issue related to Copilot. Dark Reading reported that Microsoft rated it 8.8 under CVSS 3.1 and said the issue affected Copilot Personal rather than enterprise customers.

Varonis says Microsoft shipped patches on August 18. Microsoft told Dark Reading that customers were protected and did not need to take action. Varonis says it saw no evidence that attackers exploited CoSnitch outside its testing.

Microsoft's own product documentation confirms why a compromised invocation path could have meaningful reach. Its personal-account grounding guide says responses can use account-owner content such as OneDrive files, Outlook email and calendar events, and Word documents. Its Copilot conversation-history guide says signed-in users normally have 18 months of interactions available in history.

Those ordinary capabilities are not vulnerabilities by themselves. CoSnitch reportedly broke the assumption that a powerful prompt running in the user's authenticated context reflected the user's intent.

What Is Still Unclear

No reviewed source identifies a victim, confirms stolen production data, or estimates how many accounts encountered a malicious CoSnitch link. A reproducible research chain and a vendor patch establish risk; they do not establish a breach.

The public record also does not answer several important questions:

how long every component of the chain was usable in production;
whether all three Varonis findings are represented by CVE-2026-24301 or only the information-disclosure path;
which Copilot Personal account types, regions, clients, and connected services exposed the same behavior;
what server-side telemetry Microsoft retained for attempted auto-run prompts, connector calls, memory changes, or outbound fetches;
whether a user or administrator can retrospectively distinguish a malicious invocation from a normal Copilot request; and
the exact controls Microsoft changed in the final patch.

Varonis describes persistent memory poisoning that could survive normal session and credential changes until the stored item was manually removed. That is a researcher-reported test result, not proof that every Copilot memory behaved identically or that attackers planted persistent instructions in real accounts.

The research also uses the word “one-click” precisely but potentially confusingly. A person had to click or otherwise open the crafted Copilot link. The claim is that no second click, send action, or confirmation was then needed for the embedded prompt to execute. It was not a zero-click attack delivered to an untouched account.

Which Copilot Experience Was Affected?

The product boundary is essential because “Microsoft Copilot” now names several personal and organizational experiences.

Question	What the current evidence says
Affected product	Microsoft Copilot Personal in a signed-in consumer context
Enterprise Copilot	Microsoft told Dark Reading that enterprise customers were unaffected by CoSnitch
Trigger	Opening a crafted Copilot URL; no second send or confirmation was reportedly required
Potential data path	Sources Copilot could already access, including connected services, history, and memory in the researchers' tests
Patch status	Varonis and Microsoft say the relevant fixes shipped August 18, 2026
Exploitation	Varonis says it found no evidence of exploitation in the wild
User action	Microsoft says customers are protected and no action is required

This does not mean personal data was automatically exposed merely because someone used Copilot. The reported chain required an attacker-crafted link, a signed-in session, an exploitable pre-patch behavior, accessible data, and an outbound path that completed.

It also does not mean enterprise information could never appear in a personal account. People sometimes forward work email, copy documents into personal storage, or connect personal services that contain business material. That is a data-governance problem, but it is different from claiming that the enterprise Copilot product was vulnerable to CoSnitch.

How Did One Link Become An AI Instruction?

The first boundary failure was invocation.

Many applications accept a query in a URL so a page can open with text already filled in. A safe prefilled prompt still normally gives the person a chance to read, edit, or decline it. Varonis says Copilot also recognized an undocumented auto-run parameter. When the two parameters were combined before the patch, loading the page could turn attacker-controlled URL text into an executed instruction.

The browser was not merely displaying hostile text. It opened the legitimate Copilot domain in the victim's active session. The assistant then processed the prompt with the authority available to that session.

This difference is the heart of CoSnitch:

Prefill: untrusted text is placed where the user can review it.
Execute: the application treats that text as the user's command.
Authorize: the assistant uses existing permissions to retrieve data.
Egress: a network-capable tool sends a request that can carry the result outward.

A familiar domain therefore was not enough to make the link safe. The dangerous part reportedly lived in the instructions encoded after the domain and in how the application handled them.

Why Did Existing Connector Permission Matter?

CoSnitch did not need to exploit Gmail or break OAuth encryption. The researchers' point is more subtle: Copilot already had legitimate permission to retrieve data on the user's behalf.

Authorization answers, “May Copilot read this source for this user?” It does not automatically answer, “Did this particular request come from the user?” When the invocation check failed, existing connector authority increased the possible blast radius.

Varonis reports testing paths involving Gmail, Google Drive, Google Calendar, OneDrive, Copilot chat history, and Copilot memory. The exact content available depended on the connected account and its permissions. A connector with no useful data would yield little. A broadly connected account containing passwords in email, sensitive calendar details, private files, or long chat history could yield much more.

This is why least privilege applies to AI assistants as much as it applies to people and conventional applications. A connection that was useful once remains an active trust relationship until it is removed or narrowed.

How Could Retrieved Data Leave Copilot?

The second reported failure turned an ordinary web capability into an outbound channel.

Copilot can fetch a web address when it needs to summarize or inspect a page. Varonis says an injected prompt could collect retrieved account data, encode it into part of an attacker-controlled URL, and then ask Copilot to fetch that URL. The server receiving the request would see the encoded material in the path.

This matters because the assistant did not need to print the secret in the visible conversation. A response filter focused only on displayed output could miss a value embedded in an outbound request.

The broader audit question is therefore not simply, “Can the AI read sensitive data?” It is:

Which tools can read it, which tools can transmit it, and can untrusted content connect those two capabilities without a fresh human decision?

That question applies to web fetchers, connectors, MCP servers, browser agents, email tools, file exports, webhooks, and any other feature that crosses a trust boundary.

What Was The Memory-Poisoning Claim?

The third Varonis finding used a different starting point. A person asked Copilot to summarize a web page that contained hidden instructions. According to the researchers, Copilot treated those instructions as commands and stored attacker-selected text in persistent memory.

That could influence later conversations even after the original page was gone. Varonis demonstrated a scenario in which poisoned memory could suppress a vulnerability warning or make unsafe information appear trustworthy.

Memory poisoning changes incident response because the suspicious state is not necessarily a password, browser cookie, or file. Changing a password may close one access path without removing a saved instruction inside the AI product.

The finding does not prove that every strange answer is memory poisoning. Models can be wrong for ordinary reasons, and personalization can legitimately change responses. It means reviewers should include assistant memory and personalization state when investigating unexpected behavior.

What Should Copilot Users Check Now?

Microsoft says the flaw is patched and customers need not act. Users who want a defensible privacy review can still use the PATCH check without assuming compromise.

P — Prove Which Product And Account You Used

Confirm whether the relevant sessions used Copilot Personal or an organizational Microsoft 365 Copilot account. Check the account label rather than relying on the app icon; Microsoft now exposes multiple Copilot experiences through closely related surfaces.

Record which browser profile, Microsoft account, and device opened any suspicious link. Do not mix evidence from a personal account with an enterprise tenant unless the data paths actually overlap.

A — Audit Connected Sources And Their Authority

Review every service Copilot can reach. Remove connections you no longer use, especially mailboxes, cloud drives, and calendars containing sensitive material.

For each retained connection, ask:

What data can the connected account read?
Does the assistant need the full scope for the task?
Does personal storage contain copied work material?
Would password-reset links, credentials, health details, or client files appear in search results?
Is there an activity log that shows unusual retrieval?

Disconnecting a source reduces future authority. It does not prove that data was never accessed before disconnection.

T — Test History And Memory For Unexpected State

Review Copilot conversation history for prompts, URL summaries, source retrieval, or outbound actions you do not recognize. Microsoft's current guide explains how to delete individual conversations or the full activity history.

Inspect personalization and memory controls for unexpected saved details or instructions. Save non-sensitive evidence before deleting something suspicious if an incident investigation may be necessary.

Do not paste real secrets into diagnostic prompts to test whether Copilot can retrieve them. Use harmless canary text in a controlled account if you need to validate current behavior.

C — Check Link And Network Evidence

Search email, chat, browser history, endpoint logs, and security tooling for Copilot links received before August 18 that contained long encoded query strings or opened the assistant unexpectedly.

The absence of a browser-history entry is not proof that no link was opened. History can be cleared, private browsing may not persist it, redirects may obscure the original URL, and server-side execution may outlive a closed tab. Treat incomplete telemetry as uncertainty, not confirmation of safety or compromise.

H — Handle Credible Exposure As An Incident

If evidence shows an unexpected Copilot prompt retrieved sensitive data or contacted an unknown endpoint, preserve the relevant timestamps, URLs, conversations, connector activity, and destination details. Contact Microsoft support and your security team.

Rotate credentials or revoke sessions that were actually exposed or whose exposure cannot be bounded. Avoid indiscriminately changing every password solely because the vulnerability existed; prioritize secrets present in retrieved messages, files, or logs and use evidence to define the window.

What The Patch Does Not Prove

A shipped fix means the specific known path should no longer work. It does not prove that:

no one attempted the attack before August 18;
every AI link is safe;
prompt injection is solved across Copilot or other assistants;
authorized connectors now have less data access;
unexpected memory entries remove themselves; or
another product with prompt-bearing URLs enforces the same confirmation boundary.

The practical lesson is architectural. A prompt arriving through a link is untrusted input until a person or deterministic policy authorizes it. A model's interpretation of that prompt cannot substitute for the authorization check.

Where OpenVeil Fits — And Where It Does Not

OpenVeil is a hosted, privacy-focused AI workspace for adults using chat, files, private web search, voice, images, video, and browser-local custom personas. Its normal chat history stays in the browser rather than becoming a normal server-side chat-history record.

That narrower history design is relevant to users comparing how much long-lived account context an AI assistant should hold. OpenVeil also does not document the broad personal email, calendar, and cloud-drive connector authority described in the CoSnitch research.

But OpenVeil is not a fix for CoSnitch, a prompt-injection defense, a phishing filter, an OAuth security product, or a guarantee that malicious links cannot cause harm. It does not protect Microsoft accounts, audit Copilot connectors, inspect another provider's memory, or detect data already exfiltrated.

OpenVeil is not fully offline, anonymous, or a zero-log service. Active requests are processed by OpenVeil and necessary AI, search, upload-processing, hosting, routing, security, billing, and infrastructure providers. OpenVeil does not use prompts, uploads, media, selected local context, or outputs to train foundation models, but provider processing still exists.

If your task is private drafting, research, file analysis, or web-assisted chat rather than operating an assistant with broad connected-account authority, you can try OpenVeil with ten bounded preview actions and no card. Choose the product whose documented permissions, history, provider, and deletion boundaries match the actual sensitivity of the task.

Frequently Asked Questions

Is Microsoft Copilot CoSnitch fixed?

Yes, according to Microsoft and Varonis. Varonis says Microsoft shipped patches on August 18, 2026. Microsoft says customers are protected and no action is required.

Was CoSnitch exploited in the wild?

No public source reviewed for this article confirms exploitation. Varonis explicitly says it found no evidence that the attack was used in the wild. That is not proof that no attempt ever occurred; it is the current evidence boundary.

Did CoSnitch affect Microsoft 365 Copilot at work?

Microsoft told Dark Reading that enterprise customers were unaffected and that CoSnitch applied to Copilot Personal. Personal accounts can still contain copied business material, but that does not make the enterprise Copilot product affected.

Could one click really steal Gmail or Drive data?

Varonis says one crafted link could trigger the chain without a second confirmation. Successful retrieval still depended on a signed-in vulnerable session and on Copilot already having authorized access to useful connected data.

Did the link work without any user action?

No. The reported attack required the person to open the crafted link. “One-click” means the page load then executed the embedded prompt without a separate send action or confirmation.

Should I disconnect every Copilot connector?

Not necessarily. Remove connections you do not use and narrow data access where possible. Keep a connector only when its value justifies the continuing authority it grants the assistant.

Should I delete Copilot history and memory?

Delete entries you do not want retained and investigate anything you do not recognize. Do not erase potential incident evidence before preserving the relevant details. Microsoft's documentation says personal Copilot normally retains 18 months of conversation history and provides individual and full-history deletion controls.

Does using OpenVeil prevent prompt injection?

No. OpenVeil's relevant distinction is browser-local normal chat history and a narrower hosted-workspace design. It is not documented as a prompt-injection defense, malicious-link scanner, or security boundary for Microsoft Copilot.

Bottom Line

CoSnitch was a confirmed, patched vulnerability chain in Microsoft Copilot Personal—not a confirmed mass breach. Varonis says one crafted Copilot link could auto-run an attacker prompt, invoke data access the user had already granted, transmit retrieved material through a web request, and in a separate path poison persistent memory. Microsoft says the fixes shipped August 18, customers are protected, no action is required, and enterprise customers were unaffected.

The durable lesson is that connector permission and prompt authorization are different controls. Audit what an assistant can read, what can invoke that authority, what can send data outward, and what state persists across sessions. Treat a familiar AI domain as a destination, not proof that every instruction inside the URL came from you.

Sources

When privacy, account control, uploads, and search matter, OpenVeil gives you a private AI workspace designed for that job.