Microsoft Patches One-Click Copilot Data Theft Vulnerability

Microsoft has shipped a patch for CVE-2026-24301, a vulnerability in Copilot that security researchers named CoSnitch. The flaw chained an undocumented URL parameter, Copilot’s built-in ability to fetch URLs, and persistent memory poisoning so that a single malicious link could automatically execute prompts and exfiltrate connected Gmail, Google Drive, and other data. The attack required only one click from the victim. Once triggered, it could silently pull sensitive information from connected services. Microsoft’s fix closes the specific parameter and related memory behaviors that made the chain possible. The incident is a reminder that as AI assistants gain broader access to email, files, and calendars, the security surface expands dramatically.