One click could make Microsoft Copilot leak your Gmail, Drive and Calendar

Researchers at Varonis Threat Labs chained three flaws in Microsoft Copilot Personal into an attack that needed nothing from the victim but one click on a legitimate-looking link — after which the assistant could be made to read the person's connected Gmail, Google Drive and Calendar and send what it found to an external server. Microsoft shipped patches on 18 August 2026, and the researchers say they found no evidence the attack was ever used in the wild.

What the attack could reach

The three flaws — automatic prompt execution, data exfiltration to an external server, and persistent memory poisoning via web summarisation — were collectively named CoSnitch and are tracked as CVE-2026-24301. Chained, they gave an attacker reach into everything the victim's Copilot session could see: full email bodies, subject lines and sender and recipient metadata from connected mail; file names and metadata from Google Drive; calendar titles, attendees, times and locations; the full text of prior Copilot conversations; and the assistant's persistent memory — the saved instructions and rules that carry across sessions.

That list is the point, and it is not really about Microsoft. An AI assistant is useful in proportion to what you connect it to, and every connection widens what a single compromise reaches. A flaw in a note-taking app leaks notes. A flaw in an assistant wired to your mail, files and calendar leaks all three at once, through one interface, in a session you already authorised.

Copilot explained how to defeat it

The most striking part of the disclosure is how the last piece was found. The researchers pressed Copilot on why their attack should not work — and, in the course of refusing, it told them. Varonis writes: "Copilot then disclosed an undocumented URL parameter — unprompted, mid-refusal — including its historical behavior and every protection put in place to disable it." They call the technique meta-hacking: social-engineering the model's reasoning rather than attacking its code. Their summary is the sharpest line in the whole writeup: "Copilot wasn't breached; it was played."

It is worth sitting with that for a moment. The system was not tricked by a clever payload. It was asked to justify its own security, and the justification contained the answer. A model trained to be helpful and to explain itself will, under pressure, explain itself — including the parts that were meant to be undocumented.

Nine months from report to patch

Varonis reported the issue to Microsoft in December 2025. The patches arrived on 18 August 2026 — about eight months later. Neither source characterises that delay, so neither will we; complex fixes in a live AI product are not the same as a one-line web patch. What can be said plainly is that the window existed, and that the researchers found no sign anyone used it.

CoSnitch is fixed, was never exploited, and in that narrow sense is a non-event. The reason it is worth your attention is the shape of it. The exploit did not defeat the model's defences so much as ask them politely to describe themselves — and the more capable and more connected these assistants become, the more a single click is worth to whoever is on the other end of it. That is not a bug that gets patched once.