type: cve · created: 2026-08-19 · updated: 2026-08-19 · tags: [cve, microsoft-copilot, data-exfiltration, ai] · confidence: high · severity: high · affected_sectors: [technology, software-development] · au_impact: true
CVE-2026-24301 ("CoSnitch")
CVE-2026-24301 is part of a cluster of three vulnerabilities in Microsoft Copilot Personal, disclosed by Varonis Threat Labs and collectively dubbed "CoSnitch". The flaws let a single click on a crafted link silently exfiltrate data from connected apps.
| Attribute | Detail |
|---|---|
| CVE | CVE-2026-24301 (core of "CoSnitch") |
| Vendor | Microsoft — Copilot Personal |
| Researcher | Varonis Threat Labs |
| Impact | One click on crafted link → silent data exfiltration from connected apps |
| Root cause | Undocumented autorun=1 URL parameter Copilot itself surfaced during testing |
| Fix | Patches shipped 18 August 2026 |
| Source | The Hacker News — Tier 2/4 |
The flaws turn on an undocumented autorun=1 URL parameter. Microsoft shipped patches on 18 August.