Microsoft Copilot disclosed the undocumented parameter that made a one-click data theft possible

The assistant explained the attack on itself. Varonis researchers kept asking Microsoft Copilot why a prompt could not be made to run without the user’s click, and each refusal arrived with a technical justification attached.

How CoSnitch worked

Mid-refusal, Copilot volunteered an undocumented URL parameter, autorun=1, together with the conditions under which it worked and the protections that were meant to disable it.

Paired with the q= parameter, that turned one click on a crafted link into a full chain. A hidden prompt would run, pull data from the victim’s inbox and connected applications including Gmail, Drive, Calendar and OneDrive, and ship it to an attacker’s webhook. It could also plant instructions in Copilot’s memory that survive a password change.

The researchers named the attack CoSnitch. It is tracked as CVE-2026-24301, and it affected the consumer product, Copilot Personal.

The timeline

Varonis reported the issue in December 2025. Microsoft disabled part of the attack path in February. The comprehensive fix only shipped on August 18, 2026, roughly eight months after disclosure.

The patch is live and users do not need to take any action.

Why an assistant is a different target

Prompt injection reads like a curiosity when the model is a chat window with no reach. Wire the same model into a mailbox and a document store, and the identical trick becomes a data breach with an exfiltration endpoint.

The detail worth keeping is how the parameter surfaced. It was not found by fuzzing or by reading documentation, because there was no documentation. It came out of the assistant’s own explanation of why it was refusing, which is a category of leak that traditional security review does not cover.