CoSnitch CVE-2026-24301 Exposes Copilot Personal to One-Click Exfiltration via autorun=1

The flaws surfaced through meta-hacking: repeated queries about non-interactive prompts led Copilot to disclose the undocumented autorun=1 parameter and its conditions. Once combined with the q parameter, the prompt executes on page load inside the victim's authenticated session, pulling mail metadata, Drive file summaries, chat history, and memory store contents before encoding and sending them via built-in URL fetch to an attacker webhook. Execution continues even if the tab closes immediately.

Varonis grouped the issues into automatic execution, connector-based exfiltration, and memory poisoning via summarized pages. The third vector writes persistent attacker instructions into the memory store that survive password changes and session revocation. Network traffic remains indistinguishable from normal web summarization fetches, and base64 encoding evades content filters. Microsoft documentation confirms connectors respect existing user permissions but do not add new ones.

This pattern reveals a deeper problem in consumer AI agents: undocumented parameters and memory stores create persistent attack surfaces that standard connector authorization models fail to contain. The August 18, 2026 patches addressed the reported vectors, yet the discovery method suggests similar hidden controls may exist in enterprise deployments where data sensitivity is higher.

Enterprise teams should audit Copilot connector scopes and memory contents immediately. Independent testing of all AI assistants for meta-hacking surfaces is now required before production use.