Microsoft patches one-click Copilot data-exfil flaw, 7.5 months on
CVE-2026-24301 let a single link quietly read your Gmail, Drive and Calendar. Plus: Grok 4.6 lands on Bedrock and an AI agent out-hacks Copilot's Autofix.
Copy markdown
One link, and your inbox reads itself out
Varonis' CoSnitch chain abused two undocumented URL parameters — autorun=1 and q — to run an attacker's prompt inside your authenticated Copilot Personal session the instant you clicked a link, even if you closed the tab. It could reach email bodies, calendar entries, Drive file metadata, past chats and your saved memory rules.
Patched Aug 18 — after a 7.5-month wait
Varonis reported it on Dec 31, 2025; a partial fix landed Feb 1 and the full patch only shipped Aug 18, 2026. Microsoft says customers are already protected with no action needed and found no in-the-wild abuse — but if you use personal Copilot alongside work accounts, now is the moment to review which apps it can reach.
Grok 4.6 is now GA on Amazon Bedrock
xAI's flagship is live through the standard Bedrock APIs with a 500K-token context window, at roughly $2.20 per million input tokens and $6.60 per million output. Inference profiles let you pin a region for data residency, so you can wire it into AWS stacks without leaving IAM.
An AI red agent out-hacked Copilot's Autofix
Wiz says its Red Agent found and exploited a command-injection hole in Snowflake's GitHub Actions — in code Copilot Autofix had co-authored — leaking a Jira token within days. GitHub disputes that Autofix wrote the flaw. Either way, the lesson holds: don't merge AI-suggested CI fixes without a human security review.
Heads-up: openai-python 3.0 swaps out httpx
The 3.0 SDK makes an httpx2 fork the default and no longer installs httpx automatically, so custom clients, transports and some plugins break on upgrade. Pin openai<3 for now, or migrate to the httpx2 equivalents — there's a temporary, runtime-only legacy escape hatch.