Copilot made Varonis reveal its own one-click exfiltration bug
Varonis' "CoSnitch" (CVE-2026-24301) shows a single crafted link auto-runs a Copilot Personal prompt that pulls data from connected Gmail, Drive, and OneDrive, plus a separate path that permanently poisons the victim's memory. The twist: researchers "meta-hacked" the assistant into revealing its own undocumented autorun parameter. Microsoft patched August 18, 2026; no in-the-wild exploitation seen.