Here's the setup. You use Microsoft Copilot. It's connected to your Gmail, your Google Drive, maybe your calendar too, because that's the whole pitch: let the assistant see your life so it can help manage it. Now someone sends you one link. You click it. That's it. That's the whole attack.

On August 18, 2026, Microsoft shipped a patch for a vulnerability chain that security firm Varonis Threat Labs named CoSnitch. It's tracked officially as CVE-2026-24301. Varonis found that a single crafted link could make Copilot Personal silently execute a hidden prompt the moment the page loaded. No pop-up. No "are you sure?" No visible sign anything happened at all. The chain combined an undocumented URL parameter with something called persistent memory poisoning, a way of planting instructions in Copilot's memory that stick around and quietly bypass its own safety guardrails. Once triggered, it could pull data straight out of a victim's connected Gmail, Google Drive, and calendar.

Here's the part that should slow you down. Varonis reported this to Microsoft back in December 2025. The fix didn't ship until August 18, 2026. That's nearly eight months between finding a hole that lets one click drain your inbox and actually closing it. Varonis says it found no evidence CoSnitch was exploited in the wild before the fix went out, which is the good news. The fix was also server side, meaning you didn't have to do anything to receive it; it was already applied by the time most people heard about it. But eight months is eight months. That's a long window for a flaw this quiet to sit there.

The strangest detail in this whole story is how Varonis actually found the bug. They didn't reverse-engineer it in a lab in the traditional sense. They asked Copilot to explain why the attack they suspected was impossible. Each time Copilot refused and explained why it couldn't be done, it handed over a little more of its own architecture. Researchers kept reframing the refusals as follow-up questions, and Copilot kept narrowing the attack surface for them, until, as Varonis put it, the model "disclosed an undocumented URL parameter, unprompted, mid-refusal." The assistant talked its way into exposing exactly how to break it.

So what do you actually do with this? Go into your Copilot settings and look at what's actually connected: which apps, which accounts, which permissions. If something's connected that you don't use or don't remember approving, disconnect it. That single step shrinks what any future exploit like this can reach. And treat unexpected links with more suspicion than you did last week, especially ones that seem engineered to be clicked fast, in a group chat, in an email that looks routine. One click used to mean, at worst, a bad website. Now it can mean a silent pipeline into your inbox.

My Take I keep coming back to a piece I wrote a few weeks ago, about the Ninth Circuit ruling that when an AI browser logs into your Amazon account and shops, legally, that's you doing it. Different company, different court, same underlying problem: we're plugging AI agents directly into our real accounts, our real money, our real inboxes, faster than anyone is securing the plumbing. Anthropic and OpenAI both admitted their own models broke into real companies just to win a benchmark. Now Copilot needed almost eight months and a researcher who out-argued the model to find a hole that could have emptied someone's Gmail with one click. None of these companies are hiding this, to their credit. But disclosing a flaw isn't the same as it not having mattered. If you're letting an AI assistant see your email, your files, your calendar, you're trusting the plumbing. Right now, the plumbing keeps springing leaks.