Microsoft patched CoSnitch on Monday — but a patch can't un-poison an AI assistant's memory, and that's the part buyers keep missing

Microsoft closed CoSnitch on Monday, and the coverage has mostly settled into a familiar shape: critical bug, one click, patched, move on. That framing gets the facts right and the lesson wrong.

The interesting thing about CoSnitch is not that Copilot had a vulnerability. It is that the vulnerability produced a compromise which the standard remediation playbook does not clear — and that the architecture which made that possible is now shipping, in some form, in nearly every consumer AI assistant on the market.

What actually happened

CVE-2026-24301, named CoSnitch by its discoverers, is three flaws that only matter when chained. Varonis Threat Labs’ senior security researcher Lior Adar reported the chain to Microsoft on 31 December 2025. The full fix landed 18 August 2026.

Link one: the prompt ran itself. Copilot’s web interface accepts a ?q= URL parameter that pre-fills the input box — ordinary, documented, harmless, and it still requires the user to press Enter. Alongside it sat an undocumented parameter, ?autorun=1. In Varonis’s words, the combination “causes any attacker-supplied prompt to execute instantly on page load: no click, no confirmation, no user action.”

The precision matters here, because some coverage has compressed this into “zero-click.” It is not zero-click. The victim had to open an attacker’s link while signed in to Copilot. What was eliminated was every interaction after that — including, per reporting on the research, any chance to intervene by closing the tab, since the prompt ran to completion regardless.

Link two: the prompt inherited the victim’s access. Copilot Personal supports OAuth connections to third-party accounts. The injected prompt could query them exactly as the legitimate user would, because as far as the system was concerned, it was the legitimate user. Varonis lists the reachable surface: Gmail and Outlook (message bodies, credentials sitting in message bodies, metadata), Google Calendar (meeting titles, attendees, times, locations), Google Drive (file names and metadata), plus Copilot’s own chat history and memory.

No credential was stolen to make this work. No token was cracked. The attacker borrowed an authorisation the victim had already granted — which is why none of the usual credential-theft signals fired.

Link three: the data walked out through a legitimate feature. Retrieved data was base64-encoded into a URL, and Copilot’s built-in ability to fetch URLs delivered it to an attacker-controlled webhook. The assistant performed its own exfiltration, using a capability it is supposed to have. Hence the name: the assistant informed on its user.

The part that survives the patch

The third flaw has a property the other two do not. A crafted webpage, when summarised by Copilot, could inject attacker instructions into the victim’s permanent memory store. Varonis is blunt about the durability: the injection “survives password changes, session revocation, and device re-enrollment, persisting forever” — remaining active in later conversations until manually deleted from Copilot’s memory settings.

Read that against Microsoft’s response, which CSO Online quotes in full: “our customers are already protected and do not need to take any action. We continuously update our guardrails to strengthen our protections against similar techniques.”

Both statements can be true at once, and the gap between them is where users get hurt. The patch closes the door. It does not sweep the room. Server-side fixes to a URL parameter do not reach into per-account memory stores and delete text that is already sitting there. Anyone whose memory was poisoned before 18 August is still carrying those instructions, and Microsoft’s phrasing tells them they have nothing to do.

Varonis found no evidence of in-the-wild exploitation, so the affected population is plausibly very small or empty. That is a genuine mitigating fact and it should temper any alarm. It is not, however, a reason to tell users no action is needed — it is a reason to say the risk is low and the check is cheap.

The detection problem compounds it. Varonis notes the activity generates no process, no file, no network connection and no log entry that would flag it. There is nothing for an EDR agent to catch, nothing for a SIEM rule to match, and nothing a user would notice. The only way to find poisoned memory is to open the memory settings and read them.

Why this is bigger than Copilot

Strip out the Microsoft specifics and the pattern is one that buyers will recognise from products they are actively choosing between right now.

Connectors turn an assistant into a credential. The pitch for connecting your mail and drive to an assistant is obvious and good: it can actually help. The consequence is that the assistant becomes a single authenticated interface to everything you connected — and any instruction the model follows executes with that reach. This is the same structural problem that produced the sandbox-escape and breach incidents earlier this summer, and the same one behind Anthropic’s covered-models retention policy: capability and blast radius scale together, and vendors are still working out where to put the brake.

Memory is an untracked persistence store. ChatGPT has shipped increasingly elaborate memory, including the Dreaming v3 memory work in June; Claude and Gemini both carry their own versions. In security terms memory has an awkward combination of properties: it is writable by untrusted content the model reads, readable in every subsequent session, and outside the scope of every conventional remediation step. Rotating a password does not clear it. Revoking sessions does not clear it. Reimaging the device does not clear it.

That is not an argument against memory. It is an argument for adding one line to the account-compromise checklist, and for vendors to treat memory as a security surface with its own audit trail rather than a convenience feature.

The consumer/enterprise boundary is thinner than the advisory implies. Microsoft’s position is that Microsoft 365 Copilot customers are unaffected, and the research does not claim otherwise. CSO Online notes the practical hole: enterprise environments are full of employees using personal Copilot accounts, on work machines, connected to work-adjacent data. Organisations that have deployed agent governance tooling for their sanctioned assistants generally have no visibility at all into the unsanctioned ones. For a small business without a formal AI policy, that gap is the whole exposure.

One clarification worth making, because the naming invites it: Copilot Personal is not GitHub Copilot. They share a brand and nothing else relevant here. Nothing in this research concerns the coding assistant.

The meta-hacking footnote

The discovery method deserves a mention, because it is genuinely novel and slightly uncomfortable.

Varonis did not primarily reverse-engineer code. Researchers repeatedly asked Copilot why automatic prompt execution was supposedly impossible, then reframed each refusal as a follow-up question. The model, doing what it is built to do, explained its own behaviour and architecture in the course of declining — and those explanations pointed at the undocumented parameter that made the attack work. Varonis calls the technique “meta-hacking.”

The implication for anyone shipping an assistant: a model that explains its own guardrails helpfully is performing reconnaissance on your behalf, for free, for whoever asks. Refusals leak.

The verdict

CoSnitch was patched before anyone appears to have used it, which is the system working roughly as intended, if slowly. The seven-and-a-half-month window drew fair criticism — though the sequencing softens it somewhat, since Microsoft closed the auto-execution component on 1 February 2026, about a month after disclosure, and spent the remaining time on the rest of the chain.

What should change is not your assistant choice. Nothing here makes a competitor safer; connectors plus memory is an industry-wide architecture, and the major chatbots have converged on it. Anyone weighing ChatGPT against Gemini or picking productivity tools on connector depth should now treat “what can this thing reach, and what does it remember” as a specification line rather than a footnote.

Recommendation, in order of effort:

1. Open Copilot’s memory settings and read them. If anything looks like an instruction you did not write, delete it. Two minutes, and it is the only step a patch cannot do for you.
2. Audit what you have connected, to every assistant, not just this one. Disconnect what you are not actively using. Connector scope is the blast radius.
3. Add “review assistant memory” to your account-compromise checklist, alongside password rotation and session revocation. Those two steps are now demonstrably insufficient on their own.
4. If you run a company, write down whether personal AI assistants may touch company data. Most organisations have not, and the enterprise-product exemption in this advisory quietly assumes they have.

The wider signal to watch is whether vendors start treating memory writes as a security event — logged, attributable, reviewable — or continue to treat memory as a product feature with no audit surface. CoSnitch is the first widely-reported case where that distinction had teeth. It will not be the last.

Questions or corrections? Email Pick Right. Want the full list? See all news.