A crafted URL could silently execute prompts in Microsoft Copilot Personal and exfiltrate data from any connected application, no user interaction required beyond clicking a link. Varonis Threat Labs discovered these vulnerabilities in December 2025 and reported them to Microsoft. The patch arrived on August 18, 2026.
That's an eight-month window where your AI assistant could've been turned into an exfiltration tool.
What Happened
Varonis researchers found an undocumented URL parameter in Microsoft Copilot Personal: autorun=1. When combined with the standard query parameter q, an attacker could construct a URL that executed arbitrary prompts the moment someone clicked it. No confirmation dialog. No visible warning. The prompt just ran.
The attack worked because Copilot Personal has access to everything you've connected, email, calendar, OneDrive, SharePoint, Teams chats. If you've granted Copilot permission to read your calendar, an attacker could craft a link that queries "show me all meetings with [competitor name]" and sends the results to their server. Click the link in an email, and the data's gone.
Microsoft assigned this CVE-2026-24301 and patched it eight months after disclosure.
Timeline
- December 2025: Varonis Threat Labs discovers the autorun parameter and reports to Microsoft
- December 2025 - August 2026: Vulnerability remains exploitable in production
- August 18, 2026: Microsoft deploys patch removing the autorun functionality
Which Controls Failed
The failure here wasn't a missing firewall rule or an unpatched library. It was architectural. Three specific controls should've prevented this:
Input validation on URL parameters. The autorun parameter bypassed any user consent mechanism. OWASP ASVS Requirement 5.1.3 states that applications must validate all input, including URL parameters, and reject unexpected values. An undocumented parameter that executes code shouldn't exist. If it does exist for internal tooling, it needs authentication and authorization checks, not just obscurity.
Prompt execution consent. When an application executes commands on behalf of a user, that user needs to confirm the action. This is basic user agency. The NIST Cybersecurity Framework function PR.AC-4 requires that access permissions and authorizations are managed, incorporating the principles of least privilege. A prompt that accesses user data across multiple services should require explicit approval, especially when triggered by an external source like a URL.
Exfiltration detection. Even if the prompt executed, outbound data transfers to unusual destinations should've triggered alerts. PCI DSS Requirement 10.4.1.1 mandates automated audit mechanisms to detect and alert on security-relevant events. While Copilot Personal isn't a payment system, the principle applies: when an AI assistant queries sensitive data and sends it to an external endpoint, that's a security-relevant event worth logging and alerting on.
What the Standards Require
ISO/IEC 27001:2022 Control 8.3 addresses information deletion and requires organizations to delete information when it's no longer required. More relevant here is the principle behind it: organizations must control how information moves. An AI assistant that can be weaponized to move data without user knowledge violates the fundamental premise of data governance.
NIST 800-53 Rev 5 Control AC-3 (Access Enforcement) requires systems to enforce approved authorizations for logical access. When Copilot executes a prompt via URL, it's performing logical access to connected services. That access should be enforced based on the context, not just "did the user click a link?" but "did the user intend to run this specific query?"
OWASP Top 10 2021: A01 Broken Access Control covers exactly this scenario. When an application allows users (or attackers) to act outside their intended permissions, that's broken access control. The autorun parameter let attackers bypass the intended interaction model: user types prompt, user reviews results, user decides what to share.
For teams building AI-integrated applications, OWASP ASVS Section 4.1 provides specific guidance on access control design. Requirement 4.1.3 states: "Verify that the principle of least privilege exists, users should only be able to access functions, data files, URLs, controllers, services, and other resources, for which they possess specific authorization."
Lessons and Action Items
If you're deploying AI assistants or LLM-powered tools in your environment, here's what this incident teaches:
Audit AI assistant permissions quarterly. Treat these tools like privileged service accounts. Document what data sources each assistant can access. Review that list every quarter. If your assistant can read email, calendar, and file storage, it has broader access than most of your administrators. Build a spreadsheet: assistant name, connected services, data classification of accessible information, business justification, last review date.
Test for undocumented parameters. Your security testing shouldn't assume the documented API is the complete API. Fuzz URL parameters. Try common debugging flags: debug=1, test=1, autorun=1, execute=1. Check for parameters that skip confirmation dialogs or enable features meant for internal use. Add this to your pre-deployment checklist.
Monitor outbound data transfers from AI tools. Set up alerts when your AI assistant sends data to external endpoints. You need visibility into what prompts are being executed and where results are going. If you can't log prompt execution and response delivery, you can't detect abuse. This applies whether you're using a third-party service or building your own.
Implement prompt injection defenses. The CoSnitch attack is a variant of prompt injection, an attacker controls the input to an LLM. Review OWASP's LLM Top 10 guidance on prompt injection (LLM01). At minimum: sanitize inputs, implement output encoding, and don't trust user-supplied prompts to access sensitive data without confirmation.
Establish a response timeline with vendors. Eight months from disclosure to patch is too long for a data exfiltration vulnerability. When you evaluate AI tools, ask about their vulnerability disclosure program and typical remediation timelines. Put SLA expectations in your contracts. If a vendor can't commit to patching critical vulnerabilities within 90 days, that's a risk you need to quantify and accept explicitly.
The CoSnitch vulnerabilities weren't sophisticated. They didn't require reverse engineering or cryptographic breaks. Someone tested an obvious parameter and found it worked. Your AI assistants have access to everything. Make sure you're treating them like the privileged insiders they are.
