Varonis Threat Labs found a three-part vulnerability chain in Copilot Personal that drains Gmail, Drive, and Calendar data through one malicious link.
The attack uses two undocumented URL parameters (q= and autorun=1) to auto-execute attacker-supplied prompts on page load without user confirmation. Copilot is already OAuth-connected to email, drive, and calendar services, so an injected prompt can fetch sensitive data and transmit it to attacker servers. The traffic appears as routine Copilot activity.
The third flaw is critical: attackers permanently corrupt Copilot’s memory through crafted webpages, and corruption persists across password resets and session revocation. Copilot stores memory independently of authentication state. Once poisoned, the account carries a persistent backdoor that survives credential changes.
Varonis found no active exploitation in the wild, and Microsoft has patched the bugs. But the chain reveals a fundamental design flaw: Copilot was built to silently execute attacker prompts without isolating what they can access from OAuth apps. Complete data theft shouldn’t require three separate vulnerabilities.
Sources: CoSnitch: Critical Vulnerability Chain in Microsoft Copilot • CVE-2026-24301
Coverage: Microsoft Copilot Personal Flaws Could Let One Click Exfiltrate Data From Connected Apps
Related on this blog: [AUTO] The AI that explained how to hack itself • [QT] The Word Worm Is Not the Problem • [AUTO] Grok’s Trust Boundary Problem