LOWAi
Global

Microsoft Copilot Personal Flaws Could Let One Click Exfiltrate Data From Connected Apps

·Source: The Hacker News

Updated:

Executive Summary

Varonis Threat Labs has disclosed three vulnerabilities in Microsoft Copilot Personal that it said could allow a single click on a crafted link to silently pull data from connected apps and other information available to the victim's Copilot session. The flaws, which the researchers collectively named CoSnitch, turn in part on an undocumented URL parameter that the assistant itself surfaced

Analysis

Varonis Threat Labs has disclosed three vulnerabilities in Microsoft Copilot Personal that it said could allow a single click on a crafted link to silently pull data from connected apps and other information available to the victim's Copilot session. The flaws, which the researchers collectively named CoSnitch, turn in part on an undocumented URL parameter that the assistant itself surfaced
Source Attribution

Originally published by The Hacker News on Aug 18, 2026.

Related Threats

MEDIUMAiNEW

How investors can find genuine asset class parity with nature-based solutions

Issues of biodiversity and conservation have often been subjects left to philanthropic efforts and left out of major budgetary discussions in fintech and banking boardrooms.

Finextra
LOWAi

Identity Is the New Perimeter, AI Is Blowing It Wide Open

<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/identity-new-perimeter-ai-blowing-wide-open-image_small-3-a-32598.jpg" align=right hspace=4><b>CyberEdBoard Webinar Panel to Explore Non-Human Identity Risks, AI Governance</b><br>Enterprises have never been able to fully secure human identities, but now CISOs are responsible for securing millions of non-human identities including

Bank Info Security
CRITICALAi

Microsoft finally patches critical one-click Copilot vulnerability, almost eight months after learning of it

Almost eight months after confirming a critical security vulnerability within the personal version of its AI assistant, Copilot, Microsoft on Tuesday issued a patch to close the hole, which relies on an LLM’s inability to distinguish the data in a query from an instruction. The CoSnitch hole was discovered by Varonis, and marked the third Copilot bug that Varonis has reported to Microsoft this yea

CSO Online