CoSnitch Flaws Enable One-Click Copilot Data Theft

Varonis Threat Labs disclosed CoSnitch, three Microsoft Copilot Personal vulnerabilities enabling one-click data exfiltration via an undocumented autorun=1 parameter. Patches shipped August 18, 2026, tracked as CVE-2026-24301. The attack also enables persistent memory poisoning through web summarization, with no evidence of in-the-wild exploitation.