Microsoft shipped the patch on Tuesday, Aug. 18. Varonis Threat Labs had reported the flaw on Dec. 31, 2025. In between sat nearly eight months in which a critical one-click vulnerability in Copilot — one capable of quietly draining a user's email, files, calendar entries and the assistant's own stored memory out to an attacker-controlled endpoint — stayed open.
The flaw, dubbed CoSnitch by the researchers who found it and tracked as CVE-2026-24301, carries a critical rating in Microsoft's Security Update Guide. Varonis says it saw no evidence of exploitation in the wild before the fix landed. But the calendar is the story. CoSnitch is the third Copilot vulnerability Varonis Threat Labs has disclosed to Microsoft this year, after Reprompt and SearchLeak, and all three share a single shape: one click on a legitimate-looking link is enough.
What CoSnitch demonstrated was not one bug but a chain of three. A crafted link could cause an attacker's instructions to run inside the victim's already-authenticated Copilot session with no confirmation step. From there, the assistant could be directed to reach into connected third-party accounts — Gmail, Drive, Calendar, OneDrive — and push what it found outward using Copilot's own ordinary ability to fetch a web address, a request that looks identical at the network layer to any other page the assistant retrieves. The third link in the chain is the one security teams should sit with longest: a poisoned webpage, once summarized, could write attacker instructions into Copilot's persistent memory. That memory does not expire, does not clear on logout, and is untouched by password resets, session revocation or device re-enrollment.
The discovery method was its own kind of warning. Varonis says its researchers never reverse-engineered anything. They asked Copilot to explain why the attack they had in mind was impossible, and each refusal arrived with a technical justification that mapped more of the architecture. Varonis calls the technique meta-hacking. "Copilot wasn't breached; it was played," the company wrote. Lior Adar, the Varonis senior security researcher who led the work, told Computerworld that Microsoft closed one element of the chain on Feb. 1, roughly a month after disclosure, and that the partial fix "lowered the other vulnerabilities significantly." The rest waited until August.
Microsoft confirmed both the flaw and the fix. "Our customers are already protected and do not need to take any action," the company said in a statement. "We continuously update our guardrails to strengthen our protections against similar techniques." Microsoft also said that "enterprise customers using Microsoft 365 Copilot are not affected," because CoSnitch lived in the consumer product, Copilot Personal. Computerworld flagged that claim as not strictly accurate, and the reasoning is hard to argue with: real enterprise environments are full of employees signed into personal Copilot accounts on managed and unmanaged devices. Microsoft has also confirmed it is moving toward a unified Copilot experience, the consumer-and-commercial app merger that began rolling out the same week and is associated internally with an effort reported as Copilot Fusion. A consumer-only carve-out is a thin shield when the consumer product is being folded into the enterprise one.
Why It Matters
Eight months is a long time to sit on a critical rating. The more uncomfortable question is whether a faster patch was ever really available. Aman Mahapatra, chief strategy officer at Tribeca Softtech, argued the delay reflects a structural conflict rather than a staffing one, because the capabilities being abused are the capabilities Microsoft is selling.
"The fix and the feature are in direct tension, which means these will not be cleanly patched so much as perpetually mitigated, and the eight-month window is what it looks like when a vendor is negotiating between its security obligation and its product roadmap on every single fix," Mahapatra said.
That is the shape of AI security debt, and it is now an enterprise liability rather than a research curiosity. Traditional patch SLAs assume a defect can be excised without removing the product's reason for existing. In agentic systems, the connector access, persistent memory and web-fetch behavior that make an assistant useful are the same machinery an attacker rides. Two decades of signature-and-anomaly detection has little to grip here: nothing crashed, no unusual port opened, no malformed payload crossed the wire.
The root cause is not Microsoft-specific. Flavio Villanustre, CISO of LexisNexis Risk Solutions Group, tied CoSnitch to the same gap behind EchoLeak (CVE-2025-32711), the zero-click Microsoft 365 Copilot flaw patched in mid-2025, and the broader run of indirect prompt-injection findings across vendors: models still cannot reliably separate untrusted data from instructions embedded inside it. A different architectural approach that separates data and instructions is needed, he said, and "this is not something that Microsoft or any other AI vendor has addressed to date."
Not everyone thinks mitigation is enough. Mark Tauschek, VP and distinguished analyst at Info-Tech Research Group, reached for an older analogy: "Much like in the old macro virus days in the late 90s and early 2000s, the only way to definitively stop it is to turn it off. Disable macros back then. Disable Copilot now."
What To Watch
Three things. Whether Copilot Fusion carries consumer-side behaviors into enterprise tenants, because a merged codebase gives "not affected" a short shelf life. Whether persistent AI memory becomes a formal incident-response artifact, since a compromise that survives credential rotation and device re-enrollment sits outside most IR runbooks. And disclosure velocity: Varonis alone has published three Copilot chains this year, plus a comparable one-click finding against Atlassian's Rovo assistant in July. If median time-to-full-fix on critical assistant flaws is measured in seasons rather than weeks, enterprise buyers should start writing AI-specific patch commitments into contracts instead of trusting the trust-center page.
“The fix and the feature are in direct tension, which means these will not be cleanly patched so much as perpetually mitigated.”— Aman Mahapatra, Chief Strategy Officer, Tribeca Softtech