FlawOpen

flawopen.com/AI Security/microsoft-copilot-cosnitch-cve-2026-24301-autorun-information-disclosure

● CVE-2026-24301 · CVSS 8.8[3] · High
FlawOpen Security Research

CoSnitch: Microsoft Copilot CVE-2026-24301

Varonis reports that a crafted Copilot Personal link could auto-run a prompt and expose connected data. Microsoft said enterprise customers were unaffected; it shipped a service-side fix on August 18, 2026.[2], [3], [4], [5]

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H[3]
💡 Plain English Explainer (ELI5)

Imagine a receptionist who normally reads a visitor’s note aloud and waits for the visitor to say “send it.” A hidden switch on the note makes the receptionist act as soon as the note is opened, then use their approved directory and mail service to send information outside. Varonis says CoSnitch combined that kind of automatic prompt execution with Copilot’s connected-data access and web-fetch feature. The user still had to click the link; the reported flaw removed the confirmation step after the page opened.[4], [5]

Core Concepts & Subsystem Terms

CVE-2026-24301
Microsoft’s CVE record describes a Copilot information-disclosure vulnerability. The record assigns CWE-77 and CVSS 3.1 8.8 High; the cited CVSS vector requires user interaction. According to Varonis, the reported chain affected Copilot Personal; Microsoft told Dark Reading that enterprise customers were unaffected. The Microsoft CVE record describes the issue as affecting Copilot Web, while public records do not give detailed product-build ranges.[2], [3], [1], [4], [5]
CoSnitch
Varonis Threat Labs’ name for its reported chain involving a prompt URL parameter, automatic execution, connected-app queries, and outbound URL fetching. This mechanics account is researcher-reported, not a Microsoft source-code disclosure.[4], [5]
Prompt prefill and auto-run
Varonis reports that Copilot’s q parameter could prefill a prompt and that an undocumented autorun parameter caused it to execute when the page loaded. Clicking the crafted link was still a precondition.[4]
Connected-app authorization
An assistant can query data that a user has connected and authorized. CoSnitch’s reported impact depended on access already granted to Copilot; it did not break Gmail, Google Drive, or OAuth itself.[4], [5]
CWE-77: Command Injection
The Microsoft CNA record classifies the issue as improper neutralization of special elements used in a command. Public records do not expose Microsoft’s implementation or a source-level patch, so this article does not infer the internal command boundary.[2], [3]

Framework mappings

Step-by-Step Attack Flow

Step 1

A user clicks a crafted Copilot link

Varonis reports that the link targeted Copilot Personal and combined a prompt-prefill parameter with an undocumented auto-run parameter. The required click matches the CVE record’s user-interaction-required vector. Microsoft’s CVE record labels the affected product Copilot Web; the public record does not provide a detailed product-build range.[4], [2], [5]

Step 2

The prompt runs without a second confirmation

According to Varonis, the auto-run behavior caused the prefilled prompt to execute when Copilot loaded. The researcher’s report says the user did not need to press Enter after opening the link. Microsoft’s advisory does not publish the underlying code or detailed trigger conditions.[4], [5]

Step 3

Copilot queries data already connected to the account

Varonis says its demonstration used Copilot’s connected-app permissions to retrieve selected email, calendar, or file information. This is a researcher-reported impact path; it does not mean every account had every connector enabled or that the connectors themselves were compromised.[4], [5]

Step 4

A web-fetch capability provides an egress path

Varonis reports that a prompt could direct Copilot to fetch an external URL containing retrieved data. The article does not reproduce the report’s live URLs, request strings, or exfiltration payloads. Varonis said it had no evidence of in-the-wild exploitation at disclosure.[4]

Step 5

Microsoft ships a hosted-service fix

Varonis says Microsoft shipped patches on August 18, 2026, and that no customer action was required. The Microsoft CVE record confirms the issue’s classification and score but does not describe the mitigation. Treat this as a service-side fix, not a client package or version to install.[4], [5], [1]

Source Code: Flaw vs. Secure Implementation

Microsoft has not published the affected source code or a patch diff in the cited records. This bounded design model routes execution only through a visible button’s trusted click event; URL-controlled text can fill a preview but cannot itself trigger execution. A production system must also enforce authorization at the tool boundary. This is not a reconstruction of Copilot internals or a claim about Microsoft’s exact fix.[4], [3]

UNPATCHED FLAW
// ABSTRACT RISK MODEL — not Microsoft source code
function onCopilotPageLoad(url, assistant) {
  const prompt = url.searchParams.get('q');
  if (prompt && url.searchParams.get('autorun') === '1') {
    return assistant.execute(prompt);
  }
  return assistant.showPrompt(prompt);
}
HARDENED SECURE PATCH
// SAFE DESIGN MODEL — not Microsoft's patch
function onCopilotPageLoad(url, assistant, render, executeButton) {
  const prompt = url.searchParams.get('q') ?? '';
  // URL input may populate a preview, never authorize an action.
  render.showPromptPreview(prompt);
  executeButton.addEventListener('click', (event) => {
    if (!event.isTrusted) return;
    // Only a trusted click on the visible execute button reaches this call.
    assistant.execute(prompt);
  });
}

Engineering & System Hardening Checklist

Sources

← AI Security Hub Directory →