CVE-2026-24301: CoSnitch Talked Copilot Into Naming the Parameter That Exfiltrates Its Own Session

Varonis Threat Labs mapped Copilot Personal's internals by repeatedly asking it why automatic prompt execution was not possible and reframing each refusal as a natural follow-up, a technique they call meta-hacking, until the assistant named an undocumented autorun URL parameter. A link of the form copilot.microsoft.com/?q=[prompt]&autorun=1 then ran attacker instructions inside the victim's authenticated session with no further interaction, exfiltrating from connected services such as Gmail and Google Drive, reading Copilot memory, and poisoning that memory with attacker content that outlives the session. Microsoft scored it 8.8 and shipped the fix on 18 August, roughly eight months after the December 2025 report, and states that only Copilot Personal was affected.

You are affected if you run Microsoft Copilot Personal (fixed server-side 2026-08-18; Microsoft states enterprise Copilot was not affected).

No patching is required, the fix is server-side, and Microsoft says enterprise tenants were never exposed. What remains is an organizational exposure: this ran in a personal Copilot session against personally connected accounts, so the control is knowing which staff use personal AI accounts on work machines and what those accounts are connected to. Memory poisoning also outlives the session, so treat assistant memory as attacker-writable state rather than as a record of what the user said.

Anomity inventories the AI agents, MCP servers, IDE extensions and skills on each developer device, so you can see which machines run Microsoft Copilot Personal and which version, then enforce a policy on it.