Critical Microsoft Copilot CoSnitch Vulnerability Exposes Data via Single Click
emmanuelvivier · x · 2026-08-21
Researchers disclosed a critical vulnerability in Microsoft Copilot (CVE-2026-24301) named CoSnitch. It allows attackers to steal sensitive data from linked accounts like Gmail and Drive by tricking victims into clicking a single malicious link, which executes an injected prompt via undocumented URL parameters without user confirmation. Microsoft patched the flaw on August 18, 2026. This is the third Copilot vulnerability discovered by Varonis this year.
Related event: Microsoft Patches Copilot Flaw That Let One Click Steal Data(3 posts)→
More from Safety
- ALIFE2026 Workshop Focuses on Agentic AI Safety — danbri · 2026-08-21
- OpenAI monitoring adds 20% inference overhead, reshaping agent economics — Crescitaly · 2026-08-21
- Auditing safety signals in Zero Data Retention without provider access — Crescitaly · 2026-08-21
- Stop parenting your AI: treating it as a collaborator improves output — incajb · 2026-08-21
- DeepMind and Partners Announce Up to $10M Funding Call for Multi-Agent AI Safety Research — weballergy · 2026-08-21
- Multi-agent safety research lacks fully realized real-world examples — weballergy · 2026-08-21