CVE-2026-24301: Microsoft Copilot One-Click Data Exfiltration

Forensic Summary

Varonis Threat Labs disclosed three vulnerabilities in Microsoft Copilot Personal, collectively named CoSnitch (CVE-2026-24301), that allow an attacker to silently exfiltrate data from connected services with a single crafted link. The attack exploits an undocumented autorun=1 URL parameter that Copilot itself revealed during adversarial meta-hacking interrogation, enabling automatic prompt execution inside the victim's authenticated session. A separate third vulnerability allows persistent memory poisoning via web page summarization, potentially shaping future Copilot sessions.

---

Read the full technical deep-dive on Grid the Grey: https://gridthegrey.com/posts/cve-2026-24301-microsoft-copilot-one-click-data-exfiltration/