Check your AI agent permissions after the Copilot bug

Microsoft Copilot's consumer edition carried a bug that let one clicked link pull email content, calendar details, and file data out of a signed in account, no further clicks needed. Microsoft shipped the full fix on August 18, roughly eight months after the flaw was first reported. If anyone on your team uses an AI assistant connected to real accounts, this is worth twenty minutes this week.

Security researchers at Varonis Threat Labs found the bug, nicknamed CoSnitch and tracked as CVE-2026-24301, by repeatedly asking Copilot why certain prompts required user confirmation until it disclosed an undocumented URL parameter. That parameter, combined with Copilot's existing query parameter, let a crafted link run an attacker's prompt the moment the page loaded. No evidence has surfaced of it being used in the wild before the patch.

What CoSnitch actually did

• Automatic execution: an undocumented autorun parameter combined with Copilot's query parameter to run an attacker's prompt on page load, skipping the confirmation step Copilot normally requires.
• Data exfiltration: the injected prompt queried whatever accounts the victim had connected, mail, calendar, Drive, OneDrive, prior chat history, and Copilot's own memory store, then encoded the results into a URL and sent them to an outside server.
• Memory poisoning: a web page that Copilot was asked to summarize could plant instructions in the assistant's permanent memory, so a malicious link was not required every time.

Personal Copilot versus the enterprise version

The bug lived in Copilot Personal, the free and consumer-paid version at copilot.microsoft.com, not in Microsoft 365 Copilot. Microsoft says 365 Copilot includes sanitization checks, task adherence verification, and audit logging that the personal version does not carry, and that customers do not need to take action. That distinction only holds if your business is actually running the enterprise product. A lot of small teams sign into the free or personal-paid Copilot with a work email because nobody set up the 365 version, which puts real client and calendar data behind the version with fewer guardrails.

Check your AI agent permissions this week

1. 1

   List what is connected

   Open the connected apps or settings page for every AI assistant your team uses and write down what it can reach: email, calendar, Drive, OneDrive, a CRM, anything with an OAuth grant.

2. 2

   Cut what nobody uses

   Revoke any connection that was set up once for a test and never used again. Fewer connections means less for a prompt injection bug to reach.

3. 3

   Separate the logins

   If your business runs on Microsoft, confirm whether people are using 365 Copilot or the personal version for work email. Move business accounts to the version with audit logging.

4. 4

   Treat AI links like email links

   A link that opens inside a chat assistant deserves the same second look you would give a link in an email. If it looks unfamiliar, do not click it from inside a signed in session.

None of this means AI assistants are off the table for a small business. It means the permissions attached to them deserve the same attention you already give a new employee's account access. If you want a hand mapping out what your automations and AI tools can actually reach, that is a conversation worth having.