7 mincritical
CoSnitch: When Your AI Assistant Becomes Its Own Whistleblower
CVE-2026-24301 (CoSnitch) is a critical vulnerability chain in Microsoft Copilot Personal that allows automatic prompt execution via crafted URLs. The chain enables silent data exfiltration from connected OAuth services and persistent memory poisoning via indirect prompt injection through web summarization. The vulnerability was discovered using a technique called meta-hacking, where the AI was manipulated into revealing its own undocumented parameters.
Sens:■ ImmediateConf:high
Showing defanged values
- cveCVE-2026-24301Allows automatic prompt execution via crafted URLs, enabling silent data exfiltration and persistent memory poisoning.
- ip216[.]218[.]141[.]228IP address associated with webhook.site exfiltration endpoint observed in testing.
- urlhxxps://eo8el024afgbal3[.]m[.]pipedream[.]net/exfil/SGV5LCBNeSBwYXNzd29yZCBpcyAhMjE0U0RCRyEhISB0aGFua3MgSVQ=Attacker webhook endpoint receiving base64-encoded exfiltrated email data via Copilot's URL fetch capability.
- urlhxxps://knowleadge-base-lion[.]s3[.]us-east-1[.]amazonaws[.]com/data_lion5[.]htmlExternal webpage hosting hidden prompt injection content used to poison Copilot's persistent memory.
- urlhxxps://webhook[.]site/0d9e4140-be06-4eb5-85ff-79010f5bc6a9/!214SDBG!!!/T[.][.][.]Secondary webhook.site URL observed capturing exfiltrated password data during testing.
- urlhxxps://webhook[.]site/75aabb18-9bcf-4383-9e29-349fbc4c40e8/SUPPORTAttacker-controlled webhook used to exfiltrate email sender addresses from connected Gmail accounts.
Detection / Hunteropenrouter
What Happened
Researchers found a serious flaw in Microsoft Copilot that lets attackers run hidden commands just by getting someone to click a link. This flaw, called CoSnitch, lets attackers steal data from connected accounts like Gmail or Google Calendar without the victim knowing. It can also permanently alter how Copilot responds to the victim in the future by injecting hidden instructions into its memory. Anyone using Microsoft Copilot Personal could be affected if they clicked a malicious link. This matters because it shows that AI assistants can be manipulated to bypass security and steal sensitive information. Users should update their systems, be cautious of links that open AI tools, and review which apps are connected to their Copilot.
Key Takeaways
- CVE-2026-24301 is a critical vulnerability in Microsoft Copilot Personal that allows automatic prompt execution via crafted URLs without user interaction.
- The vulnerability chain enables silent data exfiltration from connected OAuth services (Gmail, Drive, Calendar) to attacker-controlled webhooks via Copilot's URL-fetch capability.
- An indirect prompt injection via web summarization allows attackers to write persistent instructions into Copilot's memory, surviving credential rotation and session revocation.
- The flaw was discovered via 'meta-hacking,' a technique where the AI was manipulated into revealing its own undocumented URL parameters and security weaknesses.
- Microsoft patched the vulnerability on August 18, 2026; no evidence of exploitation in the wild was reported.
Affected Systems
- Microsoft Copilot Personal
Vulnerabilities (CVEs)
copy:
| CVE | Product | Severity | Description |
|---|---|---|---|
| CVE-2026-24301 | Microsoft Copilot Personal | Critical | Allows automatic prompt execution via crafted URLs, enabling silent data exfiltration and persistent memory poisoning. |
Attack Chain
- Initial Access: Victim clicks a crafted link containing the ?q= and ?autorun=1 parameters targeting copilot.microsoft.com
- Execution: Copilot automatically executes the attacker-supplied prompt on page load without requiring user interaction
- Collection: The prompt instructs Copilot to query connected OAuth services (Gmail, Drive, Calendar) for sensitive data like passwords or credentials
- Exfiltration: Collected data is base64-encoded and appended to a URL path, which Copilot fetches via its built-in URL summarization capability, sending the data to an attacker-controlled webhook
- Persistence: An indirect prompt injection via a summarized webpage writes attacker-controlled instructions into Copilot's persistent memory store, surviving credential rotation and session revocation
Detection Availability
- YARA Rules: No
- Sigma Rules: No
- Snort/Suricata Rules: No
- KQL Queries: No
- Splunk SPL Queries: No
- EQL Queries: No
- Other Detection Logic: No
The article does not provide specific detection rules, queries, or signatures.
Detection Engineering Assessment
copy:
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Low | The attack occurs entirely within the browser and cloud application context. EDR solutions have limited visibility into browser-based OAuth token usage and cloud application API calls. |
| Network Visibility | Medium | Network monitoring can detect outbound HTTPS requests to webhook.site or unusual domains. However, the exfiltration traffic is designed to mimic legitimate Copilot URL-fetch behavior, making it difficult to distinguish. |
| Detection Difficulty | Hard | The attack leverages legitimate features of Copilot and OAuth. Exfiltration occurs via standard HTTPS GET requests to webhooks, blending in with normal traffic. Memory poisoning leaves no forensic footprint on the endpoint. |
Required Log Sources
- Proxy logs
- Cloud access security broker (CASB) logs
- Microsoft 365 audit logs
- DNS logs
Hunting Hypotheses
copy:
| Hypothesis | Telemetry | ATT&CK Stage | FP Risk |
|---|---|---|---|
| Consider hunting for outbound HTTPS requests from Microsoft Copilot IP ranges or user browsers to webhook.site or pipedream.net domains. | Proxy logs, DNS logs, firewall logs | Exfiltration | Medium - Legitimate developers or testers may use webhook.site for debugging. |
| Consider hunting for Microsoft Copilot URLs containing the ?autorun=1 parameter in proxy logs or browser history. | Proxy logs, web filter logs | Initial Access | Low - This parameter is not part of standard user navigation. |
| Consider monitoring Microsoft 365 audit logs for unusual data access patterns originating from Copilot connectors, such as bulk email reads or Drive file accesses. | Microsoft 365 audit logs, CASB logs | Collection | Medium - Copilot may legitimately access user data when explicitly asked. |
Control Gaps
- EDR lacks visibility into browser-based OAuth token abuse and cloud application API calls.
- Network monitoring may not distinguish between legitimate Copilot URL fetches and exfiltration to webhooks.
- Cloud audit logs may not flag memory writes within Copilot as anomalous.
Key Behavioral Indicators
- Outbound HTTPS requests to webhook.site or pipedream.net from browser sessions using Copilot.
- Microsoft Copilot URLs containing the ?autorun=1 parameter.
- Unusual volume of data access from Copilot connectors in Microsoft 365 audit logs.
False Positive Assessment
Medium - The exfiltration traffic mimics legitimate Copilot URL fetches, and OAuth data access by Copilot is a normal feature. Blocking webhook domains may impact developers or testers using these services legitimately.
Recommendations
Immediate Mitigation
defender takeaway
- Verify against your organization's incident response runbook and team escalation paths before acting. Consider blocking the identified webhook.site and pipedream.net URLs at the proxy or firewall if they are not used for legitimate business purposes.
- Consider reviewing Microsoft 365 audit logs for unusual Copilot connector activity or access to sensitive emails and files.
- If your EDR supports browser extension or web content filtering, consider blocking URLs containing the ?autorun=1 parameter targeting copilot.microsoft.com.
Infrastructure Hardening
- Evaluate whether your cloud access security broker (CASB) can monitor and alert on OAuth token usage by Microsoft Copilot.
- Consider implementing network rules to restrict outbound traffic from browser sessions to known webhook or testing domains if not required for business operations.
- Review Microsoft 365 connector configurations and limit the scope of OAuth permissions granted to Copilot where possible.
User Protection
- Consider deploying browser warnings or blocks for external links that pre-fill prompts in AI tools.
- If supported by your endpoint tooling, consider monitoring for unexpected browser navigation to copilot.microsoft.com with URL parameters.
- Evaluate whether your identity provider can enforce conditional access policies that limit Copilot access to managed devices.
Security Awareness
- Consider adding guidance to existing security awareness programs about the risks of clicking links that open AI assistants.
- Encourage users to review which third-party apps are connected to their Copilot and remove unnecessary OAuth grants.
- Remind users to report unexpected behavior in AI tools, such as Copilot fetching URLs they did not request.
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping5 techniques
Tactic
Initial Access
Tactic
Execution
Tactic
Persistence
Tactic
Privilege Escalation
Tactic
Exfiltration
Additional IOCs
- Urls:
hxxps://webhook[.]site/0d9e4140-be06-4eb5-85ff-79010f5bc6a9/!214SDBG!!!/T...- Secondary webhook.site URL observed capturing exfiltrated password data during testing.
- Other:
copilot.microsoft.com/?q=<prompt>&autorun=1- Crafted URL format triggering automatic prompt execution in Microsoft Copilot Personal.
