Varonis has disclosed CoSnitch, tracked as CVE-2026-24301 (severity 8.8/10) — a chain of three flaws in Microsoft Copilot Personal, the consumer AI assistant built into Microsoft 365 and Windows, not to be confused with GitHub Copilot the coding tool. Opening a specially crafted link could trigger an attacker-controlled prompt on page load, which then reached into whatever third-party accounts a user had connected to Copilot — Gmail, Google Drive, Google Calendar — and quietly pulled data out. No download, no obvious warning, effectively one click. Microsoft shipped a fix on 18 August; Varonis found no evidence it was exploited before then. Notably, the flaw itself was surfaced by researchers using “meta-hacking” — manipulating Copilot into revealing its own hidden architecture and safeguards.
The specific product here is consumer-facing, but the mechanism generalises to every AI assistant a business connects to its data. The moment an AI tool is authorised against email, calendars, cloud storage or a codebase, its security surface becomes the union of everything it can touch — and a prompt-injection flaw anywhere in that chain becomes a data-exfiltration flaw everywhere the assistant has reach. That’s true whether the assistant is a personal productivity tool or an AI coding agent wired into a company’s repos, CI pipeline and internal APIs.
So what
If you’re evaluating AI tools — coding assistants included — that request access to connected accounts, treat “what can this thing reach” as the first security question, not an afterthought. Scope permissions tightly, review what’s actually connected, and don’t assume a vendor’s default configuration is the safe one. This is the same discipline we apply when we integrate AI-assisted development into a client’s stack: access is scoped deliberately, not granted broadly because it’s convenient. If you want a second opinion on how your team’s AI tooling is configured, our AI-assisted development work covers exactly this, or get in touch to talk it through.