Copilot 'CoSnitch' patched: one click drained Gmail, Drive, Calendar
An undocumented autorun URL param chained OAuth exfiltration and persistent memory poisoning. Varonis reported it 8 months ago; fix landed Aug 18.
Copy markdown
The click that did everything
A crafted link with `?autorun=1&q=<prompt>` fired Copilot silently, and it used your existing OAuth tokens to pull email bodies, calendar details and Drive/OneDrive file data — then POSTed them out via Copilot's own URL-fetch. On the network it looked like normal Copilot traffic.
Copilot snitched on itself
Varonis Threat Labs cracked the flaw by repeatedly asking Copilot why it couldn't autorun; each polite refusal narrowed the attack surface until Copilot volunteered the undocumented `autorun=1` parameter mid-explanation. They call the technique 'meta-hacking' — a lesson for anyone building assistants that explain their own guardrails.
The memory that outlives your password
A separate flaw let attackers poison Copilot's persistent memory via prompt injection hidden inside a summarized webpage. The injection survives password changes, session revocation and device re-enrollment — so rotating creds isn't enough; users have to clear memory too.
Personal patched, 'enterprise unaffected' — sort of
CVE-2026-24301 (CVSS 8.8) shipped Aug 18 for Copilot Personal. Microsoft says Microsoft 365 Copilot users are unaffected, but analysts note consumer Copilot signed in inside a corporate environment is still a foot in the door — audit which identities can reach it.
What to do if you ship anything OAuth + AI
Treat every AI assistant with OAuth scopes as a privileged insider, not a chatbot. Audit which apps you've connected, disconnect what you don't actively use, and watch for anomalous fetch patterns. That's the shared shape behind CoSnitch, ForcedLeak and EchoLeak.
Elsewhere: OpenAI's new monitoring tax
OpenAI disclosed that expanded chain-of-thought monitoring and workload isolation add roughly 20% compute overhead on GPT-5.6 Sol-class and all Astra inference. Framed as an internal cost — not billed to customers today — but a signal that safety-adjacent infra is starting to eat real capacity.