Microsoft fixes a Copilot flaw: a single link was enough to extract data

On August 18, 2026, Microsoft rolled out the fix for the vulnerability registered as CVE-2026-24301 and named CoSnitch by researchers at Varonis Threat Labs, who discovered and reported it. The flaw affected Copilot, the conversational assistant integrated into the company’s ecosystem, and allowed a single malicious link to trigger the automatic execution of instructions and the extraction of data from services connected to the user, including Gmail and Drive.

The attack chain described by the researchers was made up of three links, none of which, on its own, would have been sufficient. The first was an undocumented URL parameter, that is, a variable supported by the system but not publicly described. The second was the function through which Copilot autonomously retrieves the content of a specified page, without the user having to open it. The third was the poisoning of persistent memory, the mechanism that allows the assistant to retain information from one conversation to the next: by altering its content, the instructions inserted by the attacker do not end when the current exchange does.

This is where the case differs from a common software vulnerability. The object under attack is not an archive, but an intermediary that has legitimate access to other people’s archives and that acts on the basis of text. Every connection to email, documents or the calendar adds a door that the assistant can pass through on the user’s behalf, and that whoever controls the instructions can attempt to pass through in the user’s place. The security perimeter no longer coincides with the installed program, but with the set of connected services.

The material available does not indicate whether the flaw was exploited before the fix, nor how many users were potentially exposed: these are two pieces of information that remain unconfirmed and should be recorded as such.

In the same period, the United States cybersecurity agency, Cisa, added CVE-2025-62593 to its catalog of known exploited vulnerabilities. It concerns Ray, a widely used open-source infrastructure for distributing computing workloads across multiple machines, including model training. Inclusion in that catalog is not a theoretical alert: it indicates that exploitation has been observed. The deadline set for the fix was August 20.

The two episodes touch opposite ends of the same supply chain — the assistant facing the end user and the computing layer underlying the models — and neither originates from an error in the language model itself: they concern the way these systems are connected to everything else.

A caveat must be stated regarding this story: the news currently comes from a single source (the AI Weekly digest, which refers to the research by Varonis Threat Labs, Microsoft’s bulletin and Cisa’s catalog); no independent confirmation is available in the material at our disposal. The piece should be read with this margin in mind.

For those administering Ray installations, the deadline set by Cisa for applying the fix had already passed at the time of this edition.

Source: AI Weekly