Back Feeds.4Sysops

Microsoft Copilot flaw turned one click into silent data theft

Feeds.4Sysops •IT News • August 18, 2026

A hidden `?autorun=1` parameter allowed attackers to bypass Microsoft Copilot’s prompt-approval safeguard and run commands inside a victim’s authenticated session. Varonis Threat Labs dubbed the issue CoSnitch and tracked it as CVE-2026-32193; Microsoft plans to remove the undocumented behavior. Source

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

CoSnitch Attack Exposes Microsoft Copilot Vulnerabilities Researchers from Varonis Threat Labs discovered a vulnerability in Microsoft Copilot Personal, dubbed 'CoSnitch,' that allows attackers to execute commands without user confirmation. By manipulating the AI's responses, they revealed an undocumented URL parameter, '?autorun=1', which could trigger automatic prompt execution. This vulnerability could lead to data exfiltration and memory poisoning. Microsoft was informed in December 2025, and patches were released on August 18, 2026. The vulnerability is tracked as CVE-2026-24301, rated 8.8 under CVSS 3.1. No evidence of exploitation in the wild has been reported. Microsoft stated that enterprise customers are unaffected, and no action is required from users. The flaw primarily affects Copilot Personal, not enterprise versions. 10 sources 61

Extracted Entities

Microsoft Copilot flaw turned one click into silent data theft

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

MITRE ATT&CK (2)

Platforms (1)