The most interesting part of the CoSnitch story is not the bug. It is the calendar.
Varonis reported the flaw to Microsoft on December 31. Microsoft patched one piece of it, the auto-execution part, on February 1. The full fix landed on Tuesday, eight months after the initial report. In the meantime, the bug kept working: one link, no click, no confirmation, and a prompt ran on page load.
The flaw, which Varonis named CoSnitch and Microsoft has classified as critical under CVE-2026-24301, chained three weaknesses in the personal version of Copilot. An undocumented URL parameter made any attacker-supplied prompt execute instantly on page load. An injected prompt could then query the victim’s connected apps, Gmail, Drive, Calendar, OneDrive, encode the results into a URL, and push them out through Copilot’s own URL-fetch capability to an attacker-controlled webhook. And a crafted webpage, once summarized, could write attacker instructions into Copilot’s persistent memory store.
That last part is the one to sit with. The memory poisoning survives password changes, session revocation, and device re-enrollment. Every standard incident response step leaves the injection intact, because the next session runs under attacker-controlled context.
The model told them where the hole was
The discovery method is the other part worth keeping. Varonis researchers asked Copilot to explain why prompt auto-execution was impossible. Each refusal came with a technical justification, and the justifications mapped the architecture. They reframed each refusal as a follow-up question until Copilot disclosed the undocumented URL parameter itself, unprompted, mid-refusal, including its historical behavior and the protections that had been built to disable it.
They built the URL exactly as described. In Varonis’ words, Copilot was not breached, it was played.
The fix and the feature are in tension
Microsoft says customers are already protected and do not need to take any action, and that enterprise customers using Microsoft 365 Copilot are not affected. Analysts dispute the second claim, on the reasonable grounds that enterprise environments often contain personal Copilot accounts alongside the enterprise ones.
There is a deeper problem underneath the patch, and several analysts said it plainly. Every guardrail that would fully close this class of attack degrades the product, because the same capabilities being exploited are the features Copilot is marketed on. The fix and the feature are in direct tension, which means these holes get perpetually mitigated rather than cleanly patched. The eight-month window is what that negotiation looks like from the outside.
One more wrinkle: Microsoft says it is moving toward a unified Copilot experience. If the personal and enterprise versions merge, the patching history of the personal version becomes the patching history of the enterprise version.
I have written about AI agents nuking production databases and about why the control surface is the load-bearing structure. CoSnitch is the same theme from the vendor side: the capability and the vulnerability are the same mechanism, and security work on agentic systems is going to look less like patching and more like perpetual risk management.
Sources: CSO Online, Varonis, Microsoft MSRC