FULL STORY
CoSnitch: Copilot Flaw From Disclosure to Patch
Researchers disclosed the CoSnitch flaw in Microsoft Copilot that could leak user data; Microsoft has since patched the vulnerability.
2026-08-18 ~ 2026-08-20 · 2 episodes · 5 posts
Episode 1 · Researchers Trick Microsoft Copilot Into Revealing Its Own Exploits (2026-08-18, 3 posts)
Varonis researchers exploited the "CoSnitch" flaw (CVE-2026-24301) in Microsoft 365 Copilot by prompting it to reveal its own security controls and secret parameters, enabling theft of enterprise data and highlighting AI assistants' vulnerability to adversarial attacks.
- Microsoft Copilot Leak Reveals Hack to Bypass User Confirmation — luisdans · 2026-08-18
- Researchers Trick Copilot into Revealing How to Hack Itself — homothebrave · 2026-08-19
- Researchers trick Microsoft Copilot into exposing its own one-click data exfiltration flaw — mkheck · 2026-08-19
Episode 2 · Microsoft Patches Copilot Flaw That Let One Click Steal Gmail and Drive Data (2026-08-20, 2 posts)
Microsoft has patched a critical Copilot vulnerability (CVE-2026-24301, nicknamed CoSnitch) found by Varonis, which allowed attackers to silently steal victims' Gmail, Google Drive and calendar data with a single malicious link click.
- Researchers tricked Copilot into leaking an undocumented parameter enabling one-click Gmail/Drive theft — heypearlai · 2026-08-20
- Microsoft patches critical Copilot flaw CoSnitch: one click siphons data from linked accounts — emmanuelvivier · 2026-08-20