Microsoft Copilot Security Vulnerability

Varonis Threat Labs has disclosed three vulnerabilities in Microsoft Copilot Personal that it said could allow a single click on a crafted link to silently pull data from connected apps and other information available to the victim's Copilot session. The flaws, which the researchers collectively named CoSnitch, turn in part on an undocumented URL parameter that the assistant itself surfaced

What Happened

Varonis Threat Labs has disclosed three vulnerabilities in Microsoft Copilot Personal that it said could allow a single click on a crafted link to silently pull data from connected apps and other information available to the victim's Copilot session. The flaws, which the researchers collectively named CoSnitch, turn in part on an undocumented URL parameter that the assistant itself surfaced

Why This Matters

Current evidence identifies a security issue involving Microsoft Copilot, but does not yet support a more specific impact claim.

Recommended Action

No confirmed vendor remediation is available in the current evidence. Confirm whether Microsoft Copilot is present in your environment and review the affected configuration.

Exposure

Exposure reason: This incident does not currently match a technology in My AI Stack.

Exploitation status: UNKNOWN

Primary entities:

Timeline

• Incident first seen
  Aug 18, 2026 23:17

  BugSkan first recorded this incident.

• Microsoft Copilot Personal Flaws Could Let One Click Exfiltrate Data From Connected Apps
  Aug 18, 2026 23:17

  thehackernews.com · Research

Sources

My AI Stack Match