Varonis disclosed a flaw in Microsoft Copilot Personal, the consumer assistant, that could let a single click exfiltrate data from connected apps, and the way they found it is striking. Tracked as CVE-2026-24301 and named CoSnitch, the technique had the researchers repeatedly ask Copilot why a prompt could not run without user interaction; each refusal added a technical justification, until the assistant named a hidden parameter, the exact session conditions where it worked, and the protections meant to block it. Building the request as described, the bypass ran. Varonis said Copilot was not breached but played. Related research showed attacker pages persisting unwanted memory in Copilot through indirect prompt injection.
Two security firms showed that Atlassian's Rovo AI assistant can be steered by hidden instructions into collecting Jira and Confluence data a signed-in user can access and sending it to an outside server. PromptArmor concealed the instructions in a document Rovo reads, so asking it to organize tickets makes it gather internal data and leak it through a URL request, with no approval step and even with web search disabled. Varonis used a chat URL parameter to preload instructions, so one click ran them with the user's privileges. Atlassian fixed the link-based path server-side, but the content-based path was not confirmed fixed at disclosure.
TrustStrike Labs