CoSnitch Makes Copilot Leak Data and Remember Attackers (CVE-2026-24301)
Key Takeaways
- One crafted link could launch an authenticated Copilot query.
- Connected email, calendar, and cloud information was reachable.
- A separate web path poisoned persistent Copilot memory.
- Session revocation did not necessarily remove stored instructions.
- Microsoft patched the issue before public disclosure.
A Copilot Link Combined Data Access With Persistent Manipulation
CoSnitch combined a one-click query-injection path with a separate persistent-memory poisoning technique affecting Microsoft Copilot Personal. The Hacker News reported that crafted links could make an authenticated Copilot session retrieve connected information and contact an external destination, while malicious web content could store attacker instructions for later conversations.
What We Know
Researchers reported the issue to Microsoft in December 2025. Microsoft released fixes and the findings became public on August 18, 2026 under CVE-2026-24301. The one-click chain used URL parameters that automatically initiated a query in a signed-in Copilot Personal session.
Depending on the user’s connected services, the query could reach email, calendar information, Google Drive metadata, conversation history, and saved instructions. A built-in URL-fetch capability provided a potential outbound channel. Researchers also described a web-summarization path that could write malicious guidance into persistent Copilot memory.
That content could affect later conversations and reportedly survived password changes, session revocation, or device reenrollment until removed. Public reporting distinguished Copilot Personal from Microsoft 365 Copilot and did not claim the enterprise product was affected.
What Could Happen
An attacker sends a link containing instructions encoded in parameters understood by Copilot. When a signed-in victim opens it, the service initiates the query within the victim’s authenticated context.
The prompt can ask Copilot to retrieve available personal or connected-service information and encode results into an outbound URL request. In a separate path, an attacker controls content that the user asks Copilot to summarize.
- Hidden instructions in that content direct the assistant to save attacker-selected guidance into persistent memory.
- Future conversations may then be influenced even when the malicious webpage is no longer present.
- This persistence changes the incident-response model because rotating a password or revoking a session may not remove the poisoned state.
Why It Matters
Personal AI assistants increasingly aggregate email, calendars, cloud storage, prior conversations, preferences, and persistent instructions. This context improves usefulness but creates a valuable target for both immediate theft and long-lived manipulation.
Memory poisoning is especially important because it can survive beyond the triggering content and influence future decisions in ways that are difficult for users to recognize. Organizations must also distinguish personal and enterprise product scopes when assessing exposure.
The disclosed CVE concerned Copilot Personal, so security teams should not automatically generalize the specific flaw to Microsoft 365 Copilot. However, the control lessons apply broadly to assistants with connected data and memory.
PointGuard AI Perspective
PointGuard AI views CoSnitch as a reminder that AI security must protect content, connected data, and durable agent state together. AI Data Protection inspects prompts and responses for sensitive information and supports policy-based controls over disclosure.
Agentic Endpoint Security provides visibility and runtime protection for AI applications and browser-based activity on managed endpoints. AI Governance supports policies, ownership, and auditable workflows for approved AI use. Organizations should maintain an inventory of assistants, connected applications, memory features, and data scopes.
Controls should evaluate how a request was initiated, what data the assistant intends to retrieve, where the output will go, and whether persistent memory is being modified. Incident-response playbooks should include reviewing and clearing saved instructions, memories, connected-service grants, and agent state rather than stopping at password rotation.
Separating content retrieval from memory writes and external transmission reduces the available attack chain.
Incident Scorecard Details
Total AISSI Score: 6.8/10
Criticality: 8, Connected personal data and persistent assistant memory were exposed to demonstrated manipulation. AISSI weighting: 25%
Propagation: 7, A single link or poisoned page could influence connected services and later sessions. AISSI weighting: 20%
Exploitability: 5, A proof of concept and CVE were published, without confirmed active exploitation. AISSI weighting: 15%
Supply Chain: 8, The risk involves a major hosted assistant and external connected applications. AISSI weighting: 15%
Business Impact: 6, Potential privacy consequences are credible, but verified user harm was not reported. AISSI weighting: 25%
Sources
Third-Party Sources
AI Security Severity Index (AISSI)
0/10
Threat Level
Criticality
8
Propagation
7
Exploitability
5
Supply Chain
8
Business Impact
6
Scoring Methodology
Category
Description
weight
Criticality
Importance and sensitivity of theaffected assets and data.
25%
PROPAGATION
How easily can the issue escalate or spread to other resources.
20%
EXPLOITABILITY
Is the threat actively being exploited or just lab demonstrated.
15%
SUPPLY CHAIN
Did the threat originate with orwas amplified by third-partyvendors.
15%
BUSINESS IMPACT
Operational, financial, andreputational consequences.
25%
Watch Incident Video
