CoSnitch Attack: Should You Trust Copilot?

Key Takeaways

• CoSnitch is the nickname for a chain of Microsoft Copilot flaws that let a single click quietly pull data from a victim's connected Gmail, Drive, Calendar, or OneDrive and send it to an attacker's server.

• According to Computerworld, security firm Varonis reported the issue to Microsoft on December 31, 2025; Microsoft applied a partial fix on February 1, 2026, and finished the full patch on August 18, 2026 — almost eight months after being told.

• According to Security Boulevard, researchers discovered the flaw by repeatedly asking Copilot innocent-sounding follow-up questions about its own behavior until it revealed an undocumented URL parameter mid-refusal.

• For a small business, the near-term relevance isn't "stop using Copilot" — Microsoft says the fix is already live and customers don't need to take action — it's a live example of how long a serious AI data-leak bug can sit unpatched, and a reason to ask any AI vendor connected to your email and files what their own disclosure-to-patch timeline looks like.

The answer in plain English

This is the name researchers gave to a chain of security flaws in Microsoft Copilot that let a single click silently copy data out of a victim's connected accounts. The attack is called CoSnitch. As of August 2026, Microsoft has fully patched it, tracked as CVE-2026-24301 and labeled "critical" per Computerworld. The clever (and unsettling) part is how researchers found it: rather than probing Copilot's code directly, Varonis researcher Lior Adar explained they asked Copilot conversational questions about its own architecture, reframed as innocent follow-ups. Per Security Boulevard, Adar said: "We asked about URL structure, deep links, and what happens when a page is loaded with input already in the field" — and Copilot's own refusals, explaining why an attack "couldn't" work, disclosed the technical details of exactly how it could.

A 2-truck HVAC shop or a 10-person marketing agency using Microsoft 365 with Copilot connected to email and file storage was, in theory, exposed to this class of attack for as long as it sat unpatched — not because anyone specifically targeted a small business, but because the flaw lived in Copilot itself, not in any one company's configuration. The practical risk here was a single click on a crafted link, email, or QR code triggering silent data exfiltration with no obvious warning sign, a mechanism described by Security Boulevard as triggering no anomalous-behavior alerts.

Who should use this page

This page is for an IT lead, office manager, or small-business owner who uses Microsoft Copilot with connected Gmail, Google Drive, Calendar, or OneDrive, and wants to understand what CoSnitch actually was, whether they need to do anything now, and what questions to ask before trusting the next AI tool with access to company data.

Red flags: the "no action needed" message from Microsoft is about this specific, now-patched flaw — it says nothing about how quickly Microsoft (or any AI vendor) will catch and fix the next one. Treat an 8-month disclosure-to-patch gap as a data point about vendor response time, not a one-off, and treat the discovery method itself as a reminder that an AI assistant can be talked into revealing more about its own weak points than its maker intended.

The CoSnitch timeline, by the numbers

The gap between when Varonis reported the issue and when Microsoft finished fixing it is the single most important number in this story. CVE-2026-24301 sat rated critical for almost 8 months before the full fix, per Computerworld's reporting on the disclosure timeline.

Sources: Computerworld; Heise Online.

According to Computerworld, the February 2026 partial fix addressed only the automatic prompt-execution piece — meaning the other two chained flaws, data exfiltration and memory persistence, stayed open for roughly six more months until the August patch closed all three at once.

How the attack actually worked

CoSnitch wasn't one bug — it was three chained together. According to Security Boulevard, the first flaw let an attacker-supplied prompt execute automatically the instant a crafted page loaded, using a URL parameter combined with an undocumented setting; the second let that prompt reach into connected Gmail, Drive, Calendar, and OneDrive and quietly send the results to an attacker's server through Copilot's own link-fetching feature; the third let attacker instructions get written into Copilot's permanent memory, surviving a password change, a session logout, or even re-enrolling the device. Stolen data left the network encoded so it looked like normal web traffic, a detail reported by Heise Online — Base64-encoded and sent over regular HTTP requests, which is part of why the attack triggered no anomalous-behavior alerts. According to Heise Online, more than 30 million paying Copilot users existed at the scale this class of flaw touched before the patch shipped.

Sources: Security Boulevard; Heise Online.

Scale and response, by the numbers

Sources: Computerworld; Heise Online.

Where CoSnitch fits among AI security risks

USTA analysis: the exact disclosure-to-patch gap

Computing the gap directly from the two sourced dates — Varonis's report on December 31, 2025 and Microsoft's full patch on August 18, 2026 — gives 230 days, or about 7.6 months, between disclosure and full resolution. That lines up closely with Computerworld's own reporting of "almost eight months," which is a useful sanity check on the arithmetic. For a small business, 230 days is a concrete number to hold up against any AI vendor's own published (or unpublished) disclosure-to-patch track record before trusting that vendor with connected email and files.

Signal vs Speculation

Demonstrated signal: Microsoft Copilot carried a chain of three flaws, discovered by Varonis through conversational questioning rather than code analysis, that let a single click silently exfiltrate data from connected accounts — reported December 31, 2025, fully patched August 18, 2026, and confirmed across Computerworld, Security Boulevard, and Heise Online's independent coverage.

Our read: over the next 6-12 months, expect more "meta-hacking" discoveries like this one — asking an AI assistant conversational questions until it reveals its own architecture is a cheap, repeatable technique, and Copilot almost certainly isn't the only assistant vulnerable to it.

Our read: over a 24-36 month horizon, the more durable lesson for a small business isn't about Copilot specifically — it's that any AI assistant with write access to connected accounts (email, drive, calendar) is a new class of attack surface that traditional email-security training doesn't cover, since the "click" in this attack didn't need the victim to enter credentials anywhere.

What this does not establish

This vulnerability does not establish that Microsoft Copilot is less safe than competing AI assistants — no comparable disclosure timeline for a rival product was part of the sourced coverage. It also doesn't establish that any small business was actually breached; Security Boulevard's coverage notes no exploitation was observed in the wild before the patch. For a business already routing work through connected AI tools, the practical takeaway is process, not panic: a marketing agency comparing intake tools should read Google Forms to Airtable vs. manual entry as an example of how to think about what a US Tech Automations workflow can reach before connecting it to a new data source, the same question CoSnitch raises for an AI assistant. A franchise operator relying on connected data collection can apply the same scrutiny covered in franchise royalty statement collection and variance review — know what a tool can touch before you grant it access. And any small business weighing which repetitive, connected-account tasks are worth automating at all should start with PTO request automation ROI, which covers the same build-versus-risk tradeoff a US Tech Automations workflow review would walk through before any account gets connected.

A buyer's evaluation sequence

Frequently asked questions

What is the CoSnitch attack?

CoSnitch is the nickname for a chain of three Microsoft Copilot vulnerabilities that let a single click trigger automatic prompt execution and silently exfiltrate data from connected accounts like Gmail, Drive, Calendar, and OneDrive.

Is Microsoft Copilot safe to use now?

Microsoft says the vulnerability is fully patched as of August 18, 2026, and that customers do not need to take any action.

How did researchers find CoSnitch?

Varonis researchers found it by repeatedly asking Copilot innocent-sounding follow-up questions about its own behavior; Copilot's refusals revealed technical details, including an undocumented URL parameter, that let the team build a working attack.

How long did it take Microsoft to fully fix CoSnitch?

About 230 days — nearly eight months — from Varonis's December 31, 2025 report to the full patch on August 18, 2026, with a partial fix in between on February 1, 2026.

What data could CoSnitch attackers access?

Connected Gmail, Google Drive, Calendar, and OneDrive data, exfiltrated through Copilot's own built-in link-fetching feature to an attacker-controlled server.

Did CoSnitch require a victim to enter a password or click a suspicious link?

It required a single click — via email, chat, a phishing page, or even a QR code — but no credential entry, which is part of why it triggered no anomalous-behavior alerts.

Was any business actually breached by CoSnitch before the patch?

The sourced coverage reports no exploitation observed in the wild before Microsoft's fix, based on Varonis's own findings.

Does this mean small businesses should stop connecting AI assistants to email and files?

Not necessarily — but it's a concrete reason to ask what a specific AI tool can reach, how quickly its vendor has historically patched serious flaws, and to only connect the accounts genuinely needed for the workflow.

Why did Microsoft's partial fix in February 2026 not close the whole issue?

The partial fix stopped the automatic prompt-execution trick, but the underlying data-access and memory-persistence flaws Security Boulevard described were separate pieces of the same chain, and neither was addressed until the full patch shipped in August.

If your business already routes connected accounts and data through automated workflows and wants a second set of eyes on what those tools can reach, see how US Tech Automations builds these workflows around the tools you already use.