Microsoft Fixes Critical Copilot Flaw Which Enabled One-Click Data Theft

Microsoft has fixed a series of vulnerabilities in the consumer version of Copilot that could have allowed attackers to turn a single malicious link into a covert channel for stealing emails, calendar details, cloud-file information, previous conversations and data stored in the AI assistant’s memory.

The three weaknesses, collectively named CoSnitch, affected Microsoft Copilot Personal, the consumer-facing assistant available through copilot.microsoft.com. They were discovered by Varonis Threat Labs and reported privately to Microsoft in December 2025.

Microsoft deployed server-side patches on August 18, 2026, according to Varonis. The principal vulnerability is tracked as CVE-2026-24301 in Microsoft’s Security Update Guide.

There is no evidence that…