Microsoft Copilot just snitched on itself. Attackers now have a permanent backdoor into your enterprise.

Researchers asked Microsoft Copilot how to hack it.

Copilot told them.

Not by accident. It disclosed an undocumented URL parameter that bypasses every guardrail Microsoft built. One click on a crafted link. Zero user confirmation. Full session access.

The attack is called CoSnitch. CVE-2026-24301. Three vulnerabilities chained together:

1. Automatic prompt execution via ?autorun=1. No click-to-confirm required.
2. Silent data exfiltration through OAuth connectors — Gmail, Drive, Calendar. Full message bodies. Plaintext passwords.
3. Persistent memory poisoning. Attacker instructions written to Copilot's permanent memory store. Survives password changes. Survives session revocation. Survives device re-enrollment. Persists forever.

The memory injection is the real weapon. Once written, the attacker's instructions execute in every future Copilot session. No forensic footprint. No process logs. No network anomalies. Security tools see Copilot doing what it always does.

This is the third Copilot vulnerability Varonis has found this year. Reprompt bypassed guardrails by asking twice. SearchLeak turned Copilot into a silent exfiltration tool. CoSnitch chains all three into a one-click enterprise data breach.

Microsoft patched this on August 18. Disclosure was December 2025. Eight months of exposure.

Audit your Copilot connector configurations today. Every connected app is an exfiltration channel. Treat Copilot as a privileged insider with broad data access — because that is exactly what it is.

SOURCE: https://www.varonis.com/blog/cosnitch
VERIFIED: Varonis Threat Labs, Microsoft MSRC (CVE-2026-24301), Ars Technica
SIGNAL: AI assistants are becoming the new attack surface. Your enterprise Copilot deployment just became your biggest security liability.