Microsoft shipped a patch on 18 August for a flaw in its Copilot assistant, identified as CVE-2026-24301 and named CoSnitch by the researchers at Varonis Threat Labs who found it. According to their account, a single malicious link was enough to make the assistant execute instructions on the user’s behalf and send data from connected Gmail and Drive accounts to an outsider.

The new shape of the problem

Traditional security thinks in terms of code and permissions: an attacker finds a flaw in a program, runs their own instructions, and takes what they can reach.

An AI assistant introduces a different route, because it is designed to read text and act on it. If it fetches a web page, that page’s contents enter its context — and if the assistant cannot reliably distinguish between text it should treat as information and text it should treat as an instruction, then whoever wrote the page has a channel to it. Researchers call this prompt injection, and it is not a bug in the ordinary sense. It follows from what these systems are for.

We are describing the mechanism in general terms and not the specifics of how this particular chain was assembled. Our editorial standards point away from publishing operational detail that serves no reader and helps only someone attempting the same thing.

Why memory makes it worse

The element that distinguishes this case from earlier prompt injection findings is persistence.

Assistants increasingly keep memory across sessions, so they can recall preferences and context. Anything written into that memory shapes later behaviour. If an attacker can place instructions there, the compromise does not end when the conversation does — it survives closing the window, and the user has no obvious way of knowing it happened, because memory is generally invisible.

That is a meaningful change. A conventional breach leaves traces in logs. A poisoned memory looks exactly like an assistant being helpful.

Connectors are the reason it matters

An assistant with no access to anything is a limited target. The value of these products comes from connecting them to email, documents, calendars and files — and every connection widens what a compromise can reach.

This is the uncomfortable trade-off at the centre of the assistant model, and it does not have a clean resolution. The features people want are the features that make an incident consequential. It also connects directly to something we covered yesterday: agents that operate software the way a person does have, by design, the reach of a person — set out in that piece.

What was done well here

It is worth saying that this is the system working. Researchers found the flaw, reported it, the vendor patched it, and the finding was published afterwards with an identifier attached. That sequence — coordinated disclosure — is why most users were never at risk.

The open question is whether it scales. Prompt injection has been demonstrated repeatedly across different products since these assistants appeared, and no general fix exists. Vendors mitigate specific paths as they are found. That is patching instances of a problem rather than solving it, and the number of instances grows with every new connector.

For anyone using such tools with work accounts, the practical takeaway is narrow and dull: keep them updated, and be deliberate about which accounts you connect.

Sources

• AI Weekly — Varonis Threat Labs’ CoSnitch finding and the 18 August patch