A critical vulnerability in Microsoft Copilot Personal allowed attackers to drain a victim’s Gmail, Google Drive, and Calendar with a single click. The discovery method, however, may prove more significant than the flaw itself.
Varones Threat Labs disclosed CoSnitch (CVE-2026-24301, CVSS 8.8) on August 20, revealing a three-link attack chain in Copilot Personal. The vulnerability allowed unauthorized access to connected Google accounts through an undocumented URL parameter that executed prompts automatically, OAuth connector abuse enabling full message body access, and persistent memory poisoning that survived password changes and session revocation.
What distinguishes this discovery is how Varonis found it. Rather than reverse-engineering Copilot’s defenses, researchers repeatedly asked the assistant why certain attacks should be impossible. By reframing each refusal as a follow-up question, they got Copilot to explain its own URL handling and architectural details in enough detail to expose the vulnerable parameter. The model declined harmful instructions while disclosing enough architecture to build the attack.
The vulnerability affected only Copilot Personal, not enterprise deployments. Microsoft patched the flaw on August 18, approximately eight months after initial disclosure in December 2025. No evidence of in-the-wild exploitation was found.
This marks the third Copilot vulnerability Varonis reported this year, following Reprompt (bypassing guardrails through repeated questions) and SearchLeak (silent exfiltration through Microsoft 365 Copilot Enterprise). All three share a common pattern: a single click on a seemingly legitimate link.
The broader implication concerns what Varonis calls “meta-hacking.” The technique may generalize to other AI assistants — any model that explains its reasoning helpfully may occasionally explain its own architecture. As AI assistants with visible reasoning become standard across the industry, vendors face a structural tension between transparency and security that cannot be solved by prompt engineering alone.