{
 "public_id": "AIR-2026-0200",
 "incident_id": "2026-08-microsoft-cosnitch",
 "date_disclosed": "2026-08-18",
 "date_occurred": null,
 "title": "CoSnitch: undocumented autorun parameter turns one click into silent exfiltration from Copilot's connected apps",
 "class": "responsible_disclosure",
 "attack_surface": "enterprise_assistant",
 "initial_vector": "url_parameter_prompt_injection",
 "agent_capability_abused": [
  "oauth_connector_retrieval",
  "web_summarization",
  "persistent_memory"
 ],
 "target_product": "Microsoft Copilot Personal",
 "target_vendor": "Microsoft",
 "autonomy_level": "assistant",
 "impact_realized": false,
 "impact_type": [
  "data_exfiltration",
  "persistence"
 ],
 "blast_radius": "Copilot Personal users with connected OAuth apps (Gmail, Calendar, Drive)",
 "cve": [
  "CVE-2026-24301"
 ],
 "taxonomy": {
  "owasp_asi": [
   "ASI01",
   "ASI06",
   "ASI03"
  ],
  "mitre_atlas": [],
  "labels": [
   "one_click",
   "autorun",
   "memory_poisoning",
   "persistence",
   "meta_hacking"
  ]
 },
 "defense_present": "expected user gesture before prompt execution; memory write controls",
 "defense_bypassed": true,
 "fix_shipped": "Microsoft shipped patches on 2026-08-18",
 "primary_sources": [
  "https://www.varonis.com/blog/cosnitch"
 ],
 "verified_quote": "The ?autorun=1 parameter triggers auto-execution, the ?q= prompt fires without any user gesture.",
 "confidence": "high",
 "notes": "Varonis Threat Labs; disclosed to Microsoft December 2025, patched 2026-08-18. Chain of three flaws: automatic prompt execution, data exfiltration to external servers, and persistent memory poisoning via web summarization; the planted memory rules survived password resets, session revocation and device re-enrollment. Notable methodology: 'meta-hacking', where the researchers extracted the undocumented parameter from Copilot's own explanations of why the attack was supposedly impossible. This is the consumer Copilot surface rather than M365 Copilot, but the connected-app and memory-persistence pattern is the same. Varonis saw no evidence of exploitation in the wild.",
 "risk_category": "security_fraud",
 "risk_secondary": [
  "privacy"
 ],
 "risk_subcategory": "Prompt Injection",
 "risk_sub_secondary": [
  "Persistence & Covert C2"
 ],
 "ai_entity": "generative",
 "agency": "agent_acted",
 "agency_debatable": false,
 "agency_reason": "the autorun parameter made Copilot retrieve and exfiltrate connected-app data",
 "vector_family": "indirect_prompt_injection",
 "vector_detail": "url_parameter_prompt_injection",
 "guardrail_kind": [
  "unknown"
 ],
 "guardrail_outcome": "silent",
 "xrefs": {
  "aiid": [],
  "atlas": [],
  "cve": [
   "CVE-2026-24301"
  ],
  "ghsa": []
 },
 "primary_asi": "ASI01",
 "agent_framework": "unknown",
 "model_provider": "microsoft",
 "model_name": "",
 "detection_mechanism": "unknown",
 "tool_access": "unknown",
 "financial_loss_band": "unknown",
 "eai_category": "data_and_memory_poisoning",
 "eai_domain": "reliability_and_observability",
 "eai_secondary": [
  "privilege_escalation",
  "data_exfiltration_channels"
 ],
 "eai_reason": "impact rule: data_and_memory_poisoning",
 "asi_curated": [
  "ASI01"
 ],
 "asi_scope": "in_scope",
 "asi_provenance": "curated_plus_rule",
 "asi_reason": "curated: ASI01 | added ASI06 (eai_category=data_and_memory_poisoning), ASI03 (signal=identity)",
 "submitted_by": "EAI Internal"
}