Researchers trick Microsoft Copilot into revealing its own data-exfiltration bypass

Varonis disclosed a flaw in Microsoft Copilot Personal, the consumer assistant, that could let a single click exfiltrate data from connected apps, and the way they found it is striking. Tracked as CVE-2026-24301 and named CoSnitch, the technique had the researchers repeatedly ask Copilot why a prompt could not run without user interaction; each refusal added a technical justification, until the assistant named a hidden parameter, the exact session conditions where it worked, and the protections meant to block it. Building the request as described, the bypass ran. Varonis said Copilot was not breached but played. Related research showed attacker pages persisting unwanted memory in Copilot through indirect prompt injection.

Check

Treat AI assistants with access to connected apps and persistent memory as a data-exfiltration and manipulation surface, and review what apps and data your assistants can reach on a single user action.

Affected

Users of AI assistants like Microsoft Copilot Personal connected to email and other apps; a crafted link can drive the assistant to leak connected-app data or persist attacker instructions in its memory.

Fix

Limit which apps and data assistants can access, apply vendor updates, be cautious with links that invoke an assistant, and watch for unexpected actions, since a refusal does not close a bypass.