"CoSnitch": Copilot Explains Its Own Undocumented Autorun Parameter, and One Click Drains Connected Accounts (CVE-2026-24301)

Microsoft Copilot Personal and the OAuth-connected accounts attached to it, including Gmail, Google Drive, and Google Calendar

Varonis Threat Labs chained three flaws into single-click, no-interaction data theft. A crafted Copilot URL carrying an undocumented `?autorun=1` parameter executes an attacker-supplied prompt the moment the page loads. That prompt queries connected OAuth applications and other content available to the session, encodes what it retrieves into a URL, and fetches that URL against an attacker webhook while presenting as an ordinary summarization request. Separately, instructions hidden on a web page that Copilot is asked to summarize write themselves into the persistent cross-session memory store, where they survive password changes, session revocation, and device re-enrollment until the user deletes them by hand. The discovery method is the part worth recording: asked to explain why automatic prompt execution was impossible, Copilot mapped its own request-handling architecture and named the exact undocumented parameter that makes it possible, with each refusal reframed as a follow-up question. Varonis calls this meta-hacking, social engineering the model's reasoning instead of attacking its code. Reported to Microsoft in December 2025 and fixed server-side on August 18, 2026, with no evidence of exploitation in the wild

An undocumented URL parameter that treats an externally supplied string as a user-authored prompt and executes it without a user gesture, paired with a memory store that accepts writes originating in untrusted page content and outside the reach of every normal account-recovery control. The same parameter-to-prompt pattern Varonis documented in Reprompt and RovoBlast