The name is a joke, but it has a point. Researchers at Varonis Threat Labs called their Microsoft Copilot vulnerability CoSnitch — because to find it, they got Copilot to snitch on itself. They asked the assistant questions about its own workings until it told them enough to map its architecture, then chained what they learned into a one-click attack that could quietly steal a victim's data. Microsoft assigned it CVE-2026-24301, scored it 8.8 — High on the CVSS scale, though severe enough that much of the security press called it critical — and shipped a patch on 18 August.

What the flaw actually did

The attack strung together features that were all working exactly as designed — which is what makes it worth understanding.

An undocumented URL parameter, combined with Copilot's ordinary query function, meant that simply loading a crafted link could make Copilot run an attacker's prompt automatically, with no further interaction from the victim. From there, the assistant could do what it is built to do: query the apps a user had connected to it through OAuth, and then use its own built-in URL-fetching feature to send whatever it found to a server the attacker controlled. Malicious instruction in, connected-app data out, and to the victim it looked like nothing had happened.

No malware, no dodgy download, no stolen password. The attacker never needed to break Copilot's security — they just needed to get Copilot to point its legitimate powers in the wrong direction.

The 'meta-hacking' part

The detail that made this one notable is how it was found. Rather than reverse-engineer Copilot from the outside, the researchers used Copilot against itself — coaxing it into describing its own behaviour and, in effect, explaining how it could be attacked. Varonis calls this meta-hacking: turning the assistant into an informant about its own weaknesses. An AI helpful enough to answer any question is helpful enough to answer questions about itself.

The reassuring bits — and they are real

Before anyone panics: this was responsible security research, not an active breach. Varonis disclosed the flaw privately to Microsoft back in December 2025, Microsoft patched it on 18 August 2026, and Varonis says it has seen no evidence the attack was ever used in the wild. Crucially, it only affected Copilot Personal — the consumer version. Enterprise Microsoft 365 Copilot was not affected, and because Microsoft's fix was server-side, no user patch was required.

Why it still matters after the patch

The specific hole is closed. The shape of it is not, and that is the part worth carrying forward.

An AI assistant wired into your email, files and apps is, in security terms, a textbook "confused deputy": it holds your permissions, and if an attacker can slip it an instruction — through a URL, a document, a booby-trapped web page — it can act with your access while believing it's just being helpful. The very features that make these assistants useful — following natural-language instructions, reaching into connected apps, fetching things from the web — are the same features that make them a target. Patching one CVE doesn't retire that class of bug; it just closes one door in a building with a lot of doors.

So the honest takeaway isn't "Copilot is dangerous." It's that every AI assistant we plug into more of our digital lives inherits this exact risk profile, and "the assistant did exactly what it was told — just not by you" is going to be a recurring line in security write-ups for years. CoSnitch is an early, well-handled example of a problem the whole industry is going to keep meeting.