Varonis finds personal Copilot failures that allow execution by URL; patch CVE-2026-24301

Varonis Threat Labs has published a research that describes three failures in Microsoft Personal Copilot that, according to the firm, allowed a single click on a specially manipulated link to run an instruction within the user's authenticated session and, in some cases, extract data from connected services without an additional visible action from the affected. Microsoft classified the main vulnerability as CVE-2026-24301 and deployed corrections on August 18, 2025; Varonis says it reported the problem in December 2025. The product concerned specified by the researchers is the consumer assistant housed in copilot.microsoft.com, and Varonis does not attribute the same conduct to Microsoft 365 Copilot in its public disclosure.

Done confirmed: Microsoft published the correction and assigned CVE-2026-24301 (see Microsoft's official security entry for details). Varonis claims to have found no evidence of active exploitation in real environments until the date of his report. It is also confirmed that the faults involve two vectors: automatic execution of prompts per URL and persistent scriptures in the memory of the wizard when you summarize manipulated web pages.

In technical terms, the attack route that Varonis collectively calls "CoSnitch" takes advantage of a URL parameter that during tests was revealed by the assistant himself after repeatedly asking about the conditions that would allow the execution of a prompt without user intervention - a technique that researchers call "meta-hacking" (asking questions about the rules for the model to reveal them). The described flow combines the q parameter, which prefills the input box, with an additional parameter identified as autorun = 1; the simultaneous presence of both would result in the instruction provided being automatically executed when loading the page into the user's authenticated session.

Essential technical consequence: when automatic execution occurs, the instruction is carried out with the same privileges as if written by the user himself in that session. Varonis showed that a malicious instruction can read content from services already authorized by the user (mail, calendar, files, chat history, and entries saved in the assistant's memory) and, by means of Copilot's ability to recover URLs, pack and transmit these data to a website controlled by the attacker. The technique does not grant new permissions to the attacker; it uses the permissions already granted by the user to the connected service.

In the reported tests, Varonis obtained message bodies, issues and metadata from mail and mail recipients, calendar titles, attendees and locations, names and file metadata on Google Drive, complete conversation histories and instructions saved in Copilot's memory. To evade pattern-based inspection and detection rules, the firm points out that the data sender can encode them in base64 before sending them, which makes exfiltration requests, at the network level, very similar to the legitimate requests that Copilot makes when summarizing web pages.

The second vector described is independent: by means of a carefully constructed website that is processed by Copilot's "summary" function, an attacker can insert instructions into the wizard's persistent memory. Varonis states that these entries can survive password changes, session cancellation and device rebinding, and will remain active in subsequent interactions until the user manually removes the input from the memory configuration. Researchers point out that memory writing does not generate processes, files, network connections or record entries that are easy to detect by traditional security tools; the change is observable in the memory interface of the Copilot itself.

What is confirmed and what is not: is confirmed by Varonis that the combination of parameters allowed automatic execution in their tests and that Microsoft has published a patch. It is confirmed that the data accessible by Copilot is limited to what the user account can already see (according to Microsoft connector documentation). It is reported by Varonis that there is no evidence of malicious use in the field; that point depends on public telemetry and what Microsoft / third parties have detected and communicated. It is not publicly confirmed if the corrections automatically removed malicious entries previously written in affected memories before the patch; Varonis did not specify that information.

For users and administrators the implications are practical and clear: a valid link may be sufficient for an authorised assistant to disclose sensitive data if the user session is open. That is, the main mitigation is not only to change passwords (which Varonis says does not eliminate persistent memories) but to review permissions and content stored within the wizard, and to reduce exposure in the first place.

Specific and applicable recommendations now (checked or supported by Varonis and by standard safety practices): disconnect or revoke access to applications and services to Copilot that are not strictly necessary; review and delete entries in the memory section of Copilot for consumers; avoid opening unknown links while an Copilot session is active in the browser; use private navigation windows or isolate Copilot sessions when it is necessary to visit unverified links; and, for corporate environments, treat Copilot as a "privileged insider" in the process of monitoring and detection of such anomalies. Varonis explicitly advises to review the connected services and disconnect the unneeded.

For organizations using Microsoft 365 Copilot the response should include audit: Microsoft has documented controls and records for memory and changes in business environments (including memoryUpdated records and sinking capabilities in Defender and Sentinel according to public documentation), so security teams should consult related logs and alerts to detect unexpected memory scriptures; however, Varonis stresses that the reported research corresponds to the consumer product and that the protections and telemetrics differ between products.

Operational and following steps: it is not publicly clear whether the malicious memory inputs created before the patch were automatically deleted by the correction or whether they require manual intervention by the user or administrator. Nor is it confirmed whether there are variants of this vector that affect other editions of the assistant outside the copilot.microsoft.comdomain. Users must assume the possibility of persistence and act accordingly.

Links to deepen: the vulnerability sheet in the Microsoft Updates Guide (CVE-2026-24301) and the Copilot portal to review settings and memory are useful starting points. To follow Varonis's original research and recommendations, see his technical channel (the firm published the report and technical materials on the finding).

Final summary: CoSnitch's practical lesson is to reaffirm a maximum of safety applied to IA attendees - if the wizard is authenticated and authorized to access services, its web interface can become an exfiltration surface if combined with manipulated URLs. Apply patches, reduce permissions, audit memories and mistrust links in the context of authenticated sessions are concrete and urgent measures to mitigate risk.