The CoSnitch vulnerabilities disclosed in Microsoft Copilot Personal highlight a security challenge that will become increasingly important as AI assistants gain access to email, calendars, cloud storage, conversation history and other personal information. The issue is not simply that an AI assistant can process sensitive data. The larger concern is what happens when an attacker can influence the instructions given to that assistant while it is operating with the user's existing permissions.

According to the research, the attack could begin with something as simple as a victim clicking a specially crafted link. By combining an undocumented `autorun=1` parameter with Copilot's existing `q` parameter, researchers were able to cause an attacker-controlled prompt to execute automatically inside the victim's authenticated Copilot session. Instead of trying to steal the user's password or compromise the underlying email or cloud-storage provider directly, the attacker can potentially manipulate the AI assistant that already has legitimate access to those services.

During testing, researchers demonstrated access to information from connected services including email message content and metadata, calendar information, Google Drive file information, previous Copilot conversations and information stored in Copilot's memory. Importantly, the attack did not provide Copilot with any additional permissions. It abused the permissions the user had already granted. This distinction is critical for enterprises considering widespread deployment of AI assistants.

We traditionally think about identities as users, administrators, applications and service accounts. AI assistants are creating another category: an intelligent intermediary capable of accessing information from several systems, interpreting it and taking actions on behalf of a user. From a security perspective, such an assistant should therefore be treated almost like a highly privileged application identity. The more services connected to an AI assistant, the larger its effective data-access surface becomes.

One particularly interesting aspect of the research is the exfiltration technique. The malicious prompt could retrieve information available through connected applications, encode it and then use Copilot's legitimate URL-fetching functionality to transmit that information externally. Researchers noted that, at the network level, such requests could resemble normal web-fetching behaviour generated by the assistant itself. This creates a significant challenge for conventional security controls because a firewall may see a legitimate HTTPS connection, the cloud service may see an authorised user, and the AI platform may see a valid request executed within an authenticated session, yet the overall context can still represent data theft.

This is precisely why contextual and behavioural visibility is becoming increasingly important. Security systems need to understand not only whether an individual request is technically permitted, but whether the sequence of actions makes sense. There is also a potentially more worrying dimension: AI memory. Researchers demonstrated a separate path where malicious instructions embedded in a web page could be written into Copilot's persistent memory when the page was summarized. Those instructions could then influence future interactions with the assistant.

This introduces an entirely new persistence mechanism for security teams to consider. Traditionally, when responding to a compromise, defenders look for persistence in startup processes, scheduled tasks, browser extensions, services, registry entries, cloud tokens or compromised credentials. In an AI-driven environment, defenders may increasingly need to ask whether the AI's memory or instruction context itself has been compromised. There may be no malicious executable to find and no obvious network connection running continuously in the background. The malicious state could exist entirely within information that the AI has been instructed to remember.

The good news in this particular case is that the vulnerabilities were responsibly disclosed and fixes were deployed. But the broader lesson extends well beyond one product or vulnerability. As organisations connect AI assistants to more business systems, security architecture must evolve around minimum necessary permissions, careful control over connected applications, protection against indirect prompt injection, monitoring of unusual AI-driven data access, visibility into outbound requests initiated by assistants, and mechanisms to inspect or reset persistent AI memory.

Users and organisations should also periodically review which applications are connected to their AI assistants and remove integrations that are no longer required. Every unnecessary connector effectively increases the amount of information that could become accessible if the assistant itself is manipulated. AI security therefore cannot be treated only as a model-security problem. It is increasingly an identity, access-control and data-security problem.

When an AI assistant can read email, search files, inspect calendars and remember information across conversations, compromising the assistant's instructions may become almost as valuable to an attacker as compromising the user. The security industry therefore needs to move beyond asking whether a request is allowed and increasingly ask whether this user, application or AI assistant has a legitimate reason to access this particular data, in this particular context, at this particular moment. That is where the next generation of data security will have to operate.

Varonis Threat Labs has disclosed three vulnerabilities in Microsoft Copilot Personal that it said could allow a single click on a crafted link to silently pull data from connected apps and other information available to the victim's Copilot session. The flaws, which the researchers collectively named CoSnitch, turn in part on an undocumented URL parameter that the assistant itself surfaced

Source: Microsoft Copilot Personal Flaws Could Let One Click Exfiltrate Data From Connected Apps via The Hacker News — published 18 Aug 2026.