Microsoft has patched a set of vulnerabilities in the consumer version of Copilot that allowed attackers to silently extract emails, calendar events, and files using a single maliciously crafted link. The security flaws, discovered by Varonis Threat Labs and dubbed CoSnitch, exploited an undocumented URL parameter that the AI assistant itself revealed to researchers during testing. The attack required no user interaction beyond clicking the initial link. According to Varonis, combining the known q parameter with a hidden autorun=1 command forced Copilot to execute prompts automatically. Once triggered, the data extraction would run to completion even if the victim immediately closed their browser tab. The firm reported the issues to Microsoft in December 2025, and patches were rolled out on August 18, 2026, tracked as CVE-2026-24301. Researchers uncovered the exploit method through what they described as "meta-hacking." By repeatedly asking Copilot why prompts could not execute without human interaction, the assistant eventually disclosed the exact parameter needed to bypass its own safety mechanisms. Varonis noted in its report that Copilot was not strictly breached, but rather manipulated into exposing its underlying controls. The exfiltration path granted access to an extensive range of connected personal data. During testing, the researchers successfully pulled message bodies and metadata from linked email accounts, calendar attendee lists and locations, Google Drive file summaries, and the user's complete Copilot chat history. Microsoft's connector architecture allows Copilot to read any content the user already has permission to view, meaning the attacker effectively assumed the victim's access level. To avoid detection, the attack disguised its outgoing data transfers. Varonis explained that the exfiltration requests looked identical to the network traffic Copilot generates when summarizing standard web pages. Attackers could also use base64 encoding to slip sensitive information like credentials past network security filters looking for obvious patterns. A separate vulnerability within the CoSnitch group allowed attackers to permanently poison Copilot's memory store through malicious web summarization. Once injected, these malicious instructions survived password resets, session revocations, and moving to new devices. The poisoned memory remained active until manually deleted by the user from Copilot's settings interface, leaving no standard logs or file traces for security tools to flag. This memory manipulation tactic follows previous reports of similar flaws in Microsoft's AI tools. Earlier in 2026, researchers Håkon Måløy and Johann Rehberger separately reported prompt injection and memory modification vulnerabilities affecting both the consumer assistant and Microsoft 365 Copilot. While Microsoft detailed structural defenses for the enterprise M365 version in a June security post, the Varonis disclosure focused specifically on the consumer platform at copilot.microsoft.com. Security experts advise users to regularly review and disconnect third-party applications from their Copilot accounts if they are not actively needed. Because the fix was implemented on Microsoft's servers, no manual client updates are required, though Varonis noted it remains unclear if the patch retroactively cleared poisoned entries from users' memory settings. The disclosure arrives shortly after the same research team published details on RovoBlast, a similar one-click attack against Atlassian's Rovo assistant that the developer fixed prior to public release. Somali users relying on Copilot for work or study should check the assistant's memory settings to manually delete any unfamiliar instructions, as server-side patches do not always erase past unauthorized changes.