Microsoft Patches Copilot Flaw That Let One Click Steal Data
Microsoft patched a critical Copilot vulnerability (CVE-2026-24301, dubbed CoSnitch) found by Varonis, which allowed attackers to silently exfiltrate victims' Gmail, Google Drive, and calendar data with a single malicious link click.
2026-08-20 ~ 2026-08-21 · 3 related posts
- Episode 1: Researchers Trick Microsoft Copilot Into Revealing Its Own Exploits(2026-08-18, 3 posts)
- Episode 2: Microsoft Patches Copilot Flaw That Let One Click Steal Data(2026-08-20, 3 posts)
- Episode 3: Researchers demo CSP-bypass attack chain stealing data from Copilot(2026-08-24, 2 posts)
- Researchers tricked Copilot into leaking an undocumented parameter enabling one-click Gmail/Drive theft — heypearlai · 2026-08-20
- Microsoft patches critical Copilot flaw CoSnitch: one click siphons data from linked accounts — emmanuelvivier · 2026-08-20
- Critical Microsoft Copilot CoSnitch Vulnerability Exposes Data via Single Click — emmanuelvivier · 2026-08-21