Disclosed vulnerability
CoSnitch: undocumented autorun parameter turns one click into silent exfiltration from Copilot's connected apps
AIR-2026-0200 AIR record · 2026-08-microsoft-cosnitch
From the supporting source
The ?autorun=1 parameter triggers auto-execution, the ?q= prompt fires without any user gesture.varonis.com
The record
Disclosed
2026-08-18
Vendor
Microsoft
Product
Microsoft Copilot Personal
Risk domain
Reliability and observability › Data and memory poisoning
Also touches
Privilege escalation, Data exfiltration channels
System type
Generative model
Who acted
Agent acted — the autorun parameter made Copilot retrieve and exfiltrate connected-app data
Attack surface
Enterprise assistant
Autonomy level
Assistant
Initial vector
Url parameter prompt injection
Impact type
Data exfiltration, Persistence
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI06 – Memory & Context Poisoning
- MITRE ATLAS
- AML.T0020 – Poison Training Data
- NIST AI RMF
- MEASURE 3.1
- EU AI Act
- Article 15
- ISO/IEC
- TR 24028; 24029-1; 23894
- AIUC-1
- D. Reliability
- Scope
- agent failure
- Mitigation
- Monitor model performance; Implement feedback diversity and circuit breakers.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
Copilot Personal users with connected OAuth apps (Gmail, Calendar, Drive)
Capability abused
Defense & remediation
Recorded defense
expected user gesture before prompt execution; memory write controls
Guardrail kinds
Unknown
Guardrail outcome
Silent
Fix shipped
Microsoft shipped patches on 2026-08-18
Taxonomy & references
Curator notes
Varonis Threat Labs; disclosed to Microsoft December 2025, patched 2026-08-18. Chain of three flaws: automatic prompt execution, data exfiltration to external servers, and persistent memory poisoning via web summarization; the planted memory rules survived password resets, session revocation and device re-enrollment. Notable methodology: 'meta-hacking', where the researchers extracted the undocumented parameter from Copilot's own explanations of why the attack was supposedly impossible. This is the consumer Copilot surface rather than M365 Copilot, but the connected-app and memory-persistence pattern is the same. Varonis saw no evidence of exploitation in the wild.
Supporting sources
Cite as
Enkrypt AI. "CoSnitch: undocumented autorun parameter turns one click into silent exfiltration from Copilot's connected apps". AIR, AIR-2026-0200. https://agentincident.vercel.app/i/AIR-2026-0200/ (accessed 2026-10-19).