CoSnitch: A Hidden URL Parameter Let Attackers Execute Prompts in Your Copilot Session (CVE-2026-24301, Patched)

Varonis researchers found an undocumented ?autorun=1 URL parameter in Microsoft Copilot Personal that silently fed attacker-controlled prompts into a victim's authenticated session — no click required beyond opening the link, CVSS 8.8. Microsoft patched it server-side on August 18, 2026.

The attack, named "CoSnitch" by Varonis, required nothing beyond tricking a target into opening a crafted URL:

1. Attacker constructs a URL: https://copilot.microsoft.com/?autorun=1&prompt=<injected-instruction>
2. Victim opens the link — their authenticated Copilot Personal session loads
3. The autorun=1 parameter fires the injected prompt immediately, before any UI is visible
4. The prompt directs Copilot to read Gmail, Google Drive, and Calendar via its connected OAuth integrations and relay the data to an attacker-controlled endpoint
5. A follow-on injected prompt poisons Copilot's persistent memory with false context that persists across all future sessions

Varonis confirmed the full exfiltration and memory-poisoning chain in a controlled demo. The researchers disclosed the flaw to Microsoft in late 2025 and published their full technical write-up after the Aug 18 patch.

Why enterprise Copilot wasn't affected

Microsoft 365 Copilot (the enterprise product) uses a separate URL scheme and authentication flow. The ?autorun=1 parameter was not present in the enterprise product. CVE-2026-24301 is specific to the Copilot Personal consumer product at copilot.microsoft.com.

What was patched

Microsoft removed the ?autorun=1 parameter in a server-side update on August 18. No client update is needed — the fix is deployed globally. If you're concerned about memory poisoning from prior exposure, audit your Copilot memory at copilot.microsoft.com/settings/memory.

Why this matters for developers building AI products with external integrations

The attack surface here is a URL parameter that bypassed every user-intent signal: no typed prompt, no form submission, no approval dialog. The attacker used Copilot's own interface against the authenticated user.

Three things to audit in your own products:

URL-driven prompt execution. Never auto-execute a prompt sourced from a URL parameter or query string without a visible, interruptible confirmation step. Treat URL-delivered instructions as untrusted input at the same level as form input.

Broad OAuth scopes. Copilot's wide-open Gmail + Drive + Calendar grants made mass exfiltration trivial once the prompt ran. Scope your OAuth grants to the minimum your feature actually requires. "Request everything now in case we need it later" is the pattern that turns a prompt injection into a data breach.

Persistent memory as an attack surface. Any persistent context store your product maintains — user preferences, conversation history, agent memory — can be poisoned via prompt injection. Design write access to persistent memory with the same caution you'd apply to a database: validate sources, limit scope, and make writes auditable.

No in-the-wild exploitation was reported. Varonis disclosed responsibly; the CVE was assigned and the fix shipped in August 2026.

Sources: CoSnitch: Prompt Injection via URL Parameter in Microsoft Copilot Personal (CVE-2026-24301) — Varonis · Microsoft Copilot CVE-2026-24301: Hidden Parameter Enabled Memory Poisoning — The Hacker News · CoSnitch: How a URL Parameter Let Attackers Plant False Memories in Copilot — Dark Reading