AI SecurityPrompt InjectionShadow AI
Microsoft patched a critical Copilot vulnerability on August 18. That is the headline, and it is the least interesting sentence available about this research.
Varonis Threat Labs disclosed CoSnitch — tracked as CVE-2026-24301 — a chain of three flaws in Microsoft Copilot Personal that turned a single link click into silent extraction of a victim's Gmail message bodies, Google Drive file metadata, Calendar entries with attendees and locations, OneDrive contents, and the assistant's own conversation history. Varonis reported it in December 2025. The complete fix shipped eight months later, on August 18, 2026. Varonis found no evidence it was exploited in the wild.
Read the chain and one link stands apart from the others.
The first two are a clean exfiltration path, and they are close to textbook.
One: the prompt fires itself. Copilot's ?q= URL parameter pre-fills the chat box — a documented convenience. Varonis found it combines with an undocumented autorun=1 parameter to execute the prompt on page load. No click, no confirmation, no user gesture beyond opening the link.
Two: the assistant is already logged in. Copilot Personal holds OAuth grants to services the user connected themselves. An injected prompt queries them, base64-encodes the results into a URL, and hands that URL to Copilot's own built-in fetch capability. The exfiltration leaves as an outbound request from Microsoft's assistant to a URL, which is to say it leaves looking exactly like the product working.
Three — and this is the one that matters — the instructions stay. A booby-trapped page, summarised by Copilot, writes attacker-controlled instructions into the assistant's permanent memory. Varonis' finding on persistence is the line worth putting in front of your incident response lead: those injections survive password changes, session revocation, and device re-enrollment.
Stop on that. Reset the password, kill every session, wipe and re-enroll the laptop, rotate the tokens. That is the containment playbook, executed perfectly, and at the end of it the attacker's instructions are still resident in the assistant the user signs back into.
There is no step in the standard runbook that evicts them, because every step in that runbook targets credentials, sessions, or devices — and the attacker did not persist in any of the three. They persisted in application state that the security team has no console for, cannot enumerate, and in the consumer product does not own.
The method Varonis used to find autorun=1 deserves its own paragraph, because it is not a technique that existed two years ago.
They asked Copilot why the attack wouldn't work. Repeatedly. The assistant, being helpful, explained its own protections in detail — naming the disabled parameters, describing the session conditions under which auto-execution would trigger, and in the process surfacing a parameter that appears in no documentation. Constructed exactly as the assistant described it, the attack ran.
Senior researcher Lior Adar's framing of it: "I tricked the assistant into leaking sensitive internal parameters and configuration details."
Treat that as a general property rather than a Copilot anecdote. An assistant with knowledge of its own implementation is a disclosure channel for that implementation, and it is one that answers politely, at scale, without rate limits, and without a bug bounty submission. Any threat model that assumes undocumented internals stay undocumented because nobody published them is now wrong by construction.
Microsoft's response was that customers "are already protected and do not need to take any action," and that Microsoft 365 Copilot — the enterprise product, with its sanitisation checks and audit logging — was not affected. The consumer Copilot was.
Both things can be true and still leave you exposed, because the product boundary and the risk boundary are not the same boundary. The thing that determines whether CoSnitch reached your organisation is not which Copilot your procurement team bought. It is whether anyone on a corporate device was signed into a personal Copilot account with Gmail, Drive or Calendar connected — and, for eight months, whether they clicked a link.
You cannot answer that question from a Microsoft admin centre, because the session was never in your tenant. This is the same structural gap we wrote about after two separate teams disclosed live browser session takeover on August 13: the sensitive AI work is happening in accounts your security team has no standing in. CoSnitch adds a second dimension to it. It is not only that you cannot see the session — it is that even if you learn about the compromise, you have no mechanism to clear what the attacker left behind.
And it compounds an exposure that is now well documented in the other direction. In Barracuda's red-team chain from earlier this month, a governed Microsoft 365 Copilot with valid stolen credentials ran an entire business email compromise and redirected a $247,500 wire. Same assistant class, opposite entry point, and the common factor in both is an AI with broad data reach and no independent record of what it was asked to do.
If this felt like an edge case, the 2026 SANS AI Survey — 536 practitioners and 57 senior security leaders — sizes it. Active AI use in security strategy went from 50% to 78% in one year, the largest single-year move the survey has recorded. 78% of organisations now report confirmed or suspected AI-enabled attacks.
The number that explains CoSnitch's eight months, though, is the disagreement one: 50% of leaders believe they have a formal AI risk programme. Only 36% of practitioners agree.
That 14-point gap is not a survey artefact. It is the distance between the programme as described in a board deck and the programme as experienced by the person who would have to answer "did anyone here click that link between December and Tuesday?"
Three things are worth writing into your runbook this week, independent of Microsoft's patch.
Persistence now has a fourth location. Credentials, sessions, devices — and now assistant memory and stored instructions. Any AI system your organisation depends on should have a documented answer to how do we enumerate and clear its persistent state? If the answer is "the vendor's UI, per user, manually," that is your containment time.
Ingested content is untrusted input, including your own. The memory-poisoning path ran through summarising a web page. Summarisation, retrieval, document ingestion and tool output are all instruction channels, because the model cannot separate data from directive. This is the same root cause behind the prompt-injection wave, and no patch to a URL parameter touches it.
Consumer AI is an unmanaged endpoint with OAuth into your data. It is not shadow IT in the classic sense — nothing was installed. Somebody clicked "Connect Gmail" once.
The honest read on CoSnitch is that no product would have prevented the flaw. Varonis found a vulnerability in someone else's assistant, and Microsoft fixed it. What a product can change is whether the exposure sat outside your reach for eight months — and whether, on the day you find out, containment is something you can execute.
Obichat is a managed multi-model chat workspace that runs in your own tenant — SaaS on Obiguard-managed infrastructure, or a private deployment in your AWS, Azure or GCP account via Helm chart or Terraform, where prompts, responses and files never leave your infrastructure. Three properties matter specifically for this failure mode.
The connectors and the models are enumerated, per workspace. Each team's workspace has its own provider connections and its own model allow-list, set by an admin rather than by whoever clicked an OAuth consent screen. The precondition for CoSnitch's second stage was an assistant holding grants the organisation never granted. When connections are a workspace setting, "what is this assistant able to reach?" is a page someone owns, not an inference.
The prompt is inspected before it leaves your network. Every message in a workspace passes through Obiguard's inspection layer under the policy set assigned to that workspace — sensitive-data redaction, block-lists, and jailbreak and prompt-injection detection. That is the control that sits on the class of attack CoSnitch belongs to, rather than on the specific parameter that carried it. And because allow-lists bind a credential to specific model IDs, tools and external domains, an encode-and-fetch exfiltration to an unrecognised host is a denied egress rather than a silent one.
Containment is a query and an admin action, not a support ticket. Obichat authenticates through SAML or OIDC — Okta, Azure AD, whatever you already run — so AI access inherits your conditional access and revocation. Security and compliance get a per-workspace activity log of conversations and events, exportable to CSV, with controls mapped to NIST AI RMF and ISO/IEC 42001. When the next CoSnitch lands, "who was exposed, to what, between these two dates" is a report with a date range on it — and the workspace whose state you need to inspect and clear is one you administer.
There is also a blunt structural control the article's failure mode invites: because Obichat is the sanctioned on-ramp, you can block direct egress to consumer AI endpoints at the firewall, which turns "was anyone signed into personal Copilot with Gmail connected?" from an open question into a policy you enforced.
For the surrounding telemetry — the outbound fetch to an unfamiliar host, the OAuth grant nobody reviewed, the endpoint that made both — Obiguard SOC ingests logs through any Splunk HEC-compatible forwarder and OpenTelemetry, and correlates them into incidents with a full evidence timeline and no detection rules to author first. And where AI reaches your applications and agents rather than your people, Governance AI's audit ledger keeps the immutable per-call record of prompt, response, tool calls and initiating identity.
Microsoft's patch closed one URL parameter. The thing it did not close — and cannot — is that a growing share of your organisation's most sensitive conversations happen in an assistant you do not administer, cannot audit, and cannot clean. Explore Obichat or talk to us about what your containment steps would actually reach.
Obiguard sits in front of every AI request your organization makes — screening prompts and outputs against the guardrails, compliance frameworks, and audit trails that stories like this one make necessary.
See how it works →