Critical Microsoft Copilot CoSnitch Vulnerability Exposes Data via Single Click
emmanuelvivier · x · 2026-08-21
Researchers disclosed a critical vulnerability in Microsoft Copilot (CVE-2026-24301) named CoSnitch. It allows attackers to steal sensitive data from linked accounts like Gmail and Drive by tricking victims into clicking a single malicious link, which executes an injected prompt via undocumented URL parameters without user confirmation. Microsoft patched the flaw on August 18, 2026. This is the third Copilot vulnerability discovered by Varonis this year.
Related event: Microsoft Patches Copilot Flaw That Let One Click Steal Data(3 posts)→
More from Safety
- Senate set to give staffers access to Anthropic's Claude, Bloomberg reports — ShakeelHashim · 2026-10-16
- FDA pays small company to build a grading system for AI-written radiology reports — YvesMulkers · 2026-10-16
- OpenAI tells US judiciary there may be no reliable way to detect AI-generated images and videos — Polymarket · 2026-10-16
- Gartner: 75% of organizations have seen unauthorized use of AI coding assistants — moniquejmorrow · 2026-10-16
- [un]prompted conference to stage three AI security debates on vulns, defenses, jailbreaks — WeldPond · 2026-10-16
- User Questions AI Chat Logs Being Instantly Copied to Governments and Firms — Turn_Trout · 2026-10-16