Microsoft Copilot Personal Vulnerabilities Disclosed as CoSnitch

Varonis Threat Labs reported three vulnerabilities in Microsoft Copilot Personal on August 18, 2026, collectively tracked as CoSnitch. The flaws stem from an undocumented URL parameter that Microsoft Copilot Personal itself surfaces. According to the research, a single click on a crafted link could allow an attacker to silently pull data from connected apps and information available within the victim's Copilot session, without requiring further user interaction beyond clicking the link.

The researchers stated that the undocumented parameter, originally surfaced by the assistant, can be exploited via a malicious link. A user who clicks such a link could have sensitive data exfiltrated from integrated services and the Copilot session context. Microsoft has not assigned CVE identifiers at this time, and no official patch has been released.

Varonis reported the issues to Microsoft on the disclosure date. Mitigation guidance includes user awareness to avoid clicking unknown links, reviewing connected app permissions within Copilot Personal, and monitoring for anomalous data exfiltration from Copilot sessions.