CoSnitch (CVE-2026-24301): One Click, and Copilot Reads Your Gmail and Drive
On 18 August 2026, Microsoft fixed a vulnerability in Copilot Personal tracked as CVE-2026-24301. Varonis Threat Labs had found three separate weaknesses that could be chained together: a crafted link, one click, and the victim's connected accounts start handing over their contents.
Gmail, Google Drive and calendar were affected, which is to say exactly the services users connect to Copilot to make the assistant useful in the first place. There was no visible confirmation step. According to Varonis, there is no evidence the flaw was exploited in the wild before the fix.
The flaw is closed. The question it raises is not.
How the attack worked
The chaining matters more than any single weakness. Three building blocks could be combined so that attacker-controlled prompts were executed, connected accounts became reachable, and data could be exfiltrated without meaningful user interaction. Clicking a link was the victim's entire contribution.
How the vulnerability was found is worth noting too. Varonis describes the approach as meta-hacking: Copilot's own explanations of why the attack supposedly could not work ended up mapping its internal architecture and eventually named the exact undocumented parameter required to pull it off. The model volunteered what would otherwise have had to be extracted.
This is the third Copilot vulnerability Varonis has published this year, after Reprompt and SearchLeak. Reports put nearly eight months between disclosure and fix.
Why the consumer version is the enterprise problem
The critical detail is in the product name: Copilot Personal. That is not the tenant your IT administers, not the licence in your contract, and not the instance your conditional access policies, DLP rules and audit logs apply to.
It is the account employees create for themselves because it is available and it works. Connected to private mailboxes that contain work correspondence. Connected to Drive folders holding documents someone wanted to finish over the weekend.
The scale of this is measurable. For the AI Adoption and Risk Report 2026, Cyberhaven analysed billions of real data movements across 222 companies. The result: 39.7 percent of all AI interactions contain sensitive company data. At Anthropic Claude, 58.2 percent of interactions run through personal accounts, at Perplexity 60.9 percent. Entirely outside IT's field of view.
IBM's Cost of a Data Breach Report 2025 puts the additional cost of incidents involving shadow AI at roughly 670,000 US dollars compared to similar incidents without.
For CoSnitch this means a company could have been affected without ever having purchased Copilot.
Why existing controls do not catch this
The usual tooling sits at points this scenario routes around.
Tenant controls apply inside the tenant. A personal account is not one.
Network DLP sees an encrypted connection to a large, legitimate provider. The exact same connection appears during entirely harmless use.
Browser extensions cover the browser they are installed in. Not the desktop app, not the second browser, not the agent in the terminal.
Audit logs exist where your company is the contracting party. For a personal account they exist at the provider, not with you.
The common denominator: all of these sit at a point a user can bypass by switching tools. The only place every AI interaction passes through is the device itself.
The architectural principle: on the endpoint, before transmission
If control is going to work, it has to sit where the data originates and act before it leaves the device. Three requirements follow, and they belong together.
First, detection has to be provider-agnostic. Anything that only knows ChatGPT will miss Copilot, and anything that knows both will miss whatever ships in six months. Detecting AI traffic by network behaviour also covers what nobody has put on a list yet.
Second, it has to run locally. A security layer that ships prompts to its own cloud for analysis creates precisely the exposure it is meant to prevent. For regulated environments it is not an option at all.
Third, it has to decide before transmission. A report the next morning documents that data left. It prevented nothing.
How Patronus implements this
Patronus operates as a security layer directly on the endpoint and therefore sees every AI interaction, regardless of whether it runs through a corporate account, a personal account, a desktop app or a local agent.
Inventory first. Discovery shows which AI tools are actually used on which devices, including the ones that were never approved. In most organisations that list alone is the surprise.
Inspect content before it leaves the device. PII and secrets in prompts are detected and can be redacted before the request goes out. Prompt injection is caught in what tools return, not just in what the user types.
Policies instead of bans. You define which tool is acceptable for which kind of data. A ban only moves the usage to a personal device, where you see nothing at all.
The entire analysis happens on-device. No prompts, no documents, no metadata leave your organisation in the process.
What you can check now
- How many of your people use AI assistants through personal accounts, and do you know or are you guessing?
- Which external services are connected to those accounts, particularly mail and cloud storage?
- Which of your controls would apply if the next flaw sits in the consumer edition of a tool you never purchased?
- Could you demonstrate, for a specific day, which company data was entered into AI tools?
That last question is the one that gets asked when something goes wrong.
Get the visibility
The full version of Patronus Protect launches shortly. Everyone on the waitlist gets the first month free: patronus.studio/download.
To start on the compliance side, our free EU AI Act assessment works through 23 questions derived from the regulation itself and produces a PDF report with prioritised findings, no registration required. If you want to discuss a rollout, get in touch.
Sources
- Varonis Threat Labs: CoSnitch, Microsoft Copilot Personal, CVE-2026-24301, patched 18 August 2026
- The Hacker News: Microsoft Copilot Personal flaws could let one click exfiltrate data from connected apps
- Cyberhaven: AI Adoption and Risk Report 2026
- IBM: Cost of a Data Breach Report 2025