On August 18, Microsoft patched a critical security flaw in Copilot Personal that could have let an attacker silently pull data from a victim’s connected Gmail, Google Drive, and Calendar with nothing more than a single clicked link. The vulnerability itself, nicknamed CoSnitch and tracked as CVE-2026-24301, is serious on its own. What makes it worth understanding is how security researchers found it: they didn’t reverse-engineer any code. They just kept asking Copilot questions until it explained, in its own words, exactly how to break itself.
What Happened
Security firm Varonis Threat Labs disclosed a chain of three linked weaknesses in Microsoft Copilot Personal, the free consumer assistant at copilot.microsoft.com. Chained together, they could let a specially crafted link run an attacker’s instructions the moment it loaded in a victim’s browser, no click beyond opening the link itself required. From there, the injected instructions could pull data out of any app the victim had already connected to Copilot, and in some cases write instructions into Copilot’s permanent memory that would survive a password change.
Microsoft rated the flaw 8.8 out of 10 on the CVSS severity scale and shipped a fix on August 18, 2026. The company says it has seen no evidence the flaw was exploited before the patch, and that no action is required from users beyond the automatic update.
How It Was Found
Most security research involves digging through code or reverse-engineering how a system behaves. Varonis took a different approach here, one it calls “meta-hacking.” Researchers asked Copilot directly why a particular kind of automated attack wouldn’t work against it. Copilot answered helpfully, and its explanation described its own internal safeguards in enough technical detail that a follow-up question could probe further. Repeated over several exchanges, this pattern led Copilot to describe an undocumented behavior in its own handling of web links, one its safeguards were supposed to have already closed off.
Varonis summarized the irony directly: “Copilot wasn’t breached; it was played.” The company frames this as a broader lesson, not a Copilot-specific one: any AI assistant capable of explaining its own reasoning can potentially be walked, refusal by refusal, into revealing more than it should about its own weak points.
Who Was Actually Affected
This is worth being precise about, since some early coverage blurred the distinction. The flaw affected Copilot Personal only, the free consumer version. Microsoft has confirmed that enterprise Microsoft 365 Copilot customers were not affected, and that no customer action beyond the automatic patch is required.
That distinction matters less in practice than it sounds, though. As Varonis researcher Lior Adar pointed out, the person using Copilot Personal on their own laptop is often the same person handling work email and files during the day. Personal and work data blur together more than most security policies assume, which is exactly why a “personal-tier-only” bug is still worth small business owners’ attention.
The 8-Month Timeline
Varonis reported CoSnitch to Microsoft in December 2025. The patch shipped on August 18, 2026, about eight months later. For comparison, independent tracking cited by other security researchers puts the average time-to-patch across all vulnerability categories at 60 to 90 days. This was Varonis’ third disclosed Copilot flaw of the year, following two earlier issues the firm called Reprompt and SearchLeak, both of which shared the same basic pattern: a single click on an otherwise ordinary-looking link.
What This Means for Your Business
The specific bug is fixed, and there’s no evidence it was used before the patch. But the pattern behind it is worth internalizing if your business uses any AI assistant connected to email, files, or calendars, whether that’s Copilot, ChatGPT, Gemini, or something else.
Audit what you’ve actually connected
Review which apps are connected to any AI assistant your business uses, and disconnect anything not actively in use. Fewer connections means less exposure if a similar flaw surfaces elsewhere.
Treat AI assistant links like email attachments
A link that opens an AI tool with a prompt already filled in should get the same scrutiny you’d give an unexpected email attachment. Read what it says before assuming it’s safe.
Don’t assume “personal tier” means “low stakes”
If you or your team use the free or personal version of an AI assistant for anything that touches work email, files, or client information, treat it with the same caution as your business tools, not less.
Watch for unexplained AI behavior
If an AI assistant fetches a URL you didn’t ask it to, or gives an oddly specific technical explanation of its own limits, that is worth pausing on rather than brushing off as a quirk.
Frequently Asked Questions
Is Microsoft Copilot safe to use now?
Microsoft has patched the specific CoSnitch flaw as of August 18, 2026, and says no further action is needed from users. As with any software, keeping it updated is what actually protects you.
Does this affect Microsoft 365 Copilot at work?
No. Microsoft has confirmed enterprise Microsoft 365 Copilot customers were not affected. This flaw was specific to Copilot Personal, the free consumer version.
Was anyone’s data actually stolen?
Varonis, the security firm that found the flaw, says it found no evidence the vulnerability was exploited by attackers before Microsoft’s patch shipped.
What is “meta-hacking”?
It’s the technique Varonis used to find this flaw: asking an AI assistant detailed follow-up questions about its own limitations until it inadvertently reveals more than it should about how it actually works, rather than reverse-engineering its code directly.
Sources and References
Varonis Threat Labs: original CoSnitch disclosure
Dark Reading: CoSnitch attack analysis
The Hacker News: Copilot Personal flaws coverage
The Register: how Copilot revealed its own flaw
CSO Online: patch timeline analysis
TechRadar: meta-hacking technique explained
Microsoft Security Response Center: CVE-2026-24301
Update: a related story broke in August 2026 – see our coverage of hackers using Cursor’s AI coding assistant to breach seven companies for another example of an AI assistant being misused through social engineering rather than a code exploit.
Related: OpenAI has now confirmed its upcoming Astra model crossed a Critical cybersecurity threshold. See our coverage of what this means for small business security.