Filed under: Cybersecurity — Data Protection — August 2026

What happened

Security researchers at Varonis found a flaw, nicknamed “CoSnitch” (CVE-2026-24301), in Microsoft Copilot Personal — the AI assistant built into Windows and Edge. By chaining three separate bugs, a single click on a crafted link could get Copilot to quietly reach into accounts it’s connected to, like email or OneDrive, and send data out to an attacker, with no further clicks or approval needed. Microsoft finished the fix on August 18, 2026. Researchers found no evidence it was ever used in a real attack — this was caught and closed before it became a live threat.

Why it matters to your business

Copilot now ships built into Windows 11 and Edge, and many employees are signed in with the same Microsoft account they use for work email and files. If that account is connected to anything business-related, a bug like this means a single bad link could have leaked company data without anyone noticing anything was wrong.

What to do this week

The fix is already out, so the main job is making sure it actually reaches your machines. Check Settings > Windows Update to confirm updates are current, and in Office apps go to File > Account > Update Options > Update Now. Remind staff that links tied to AI assistants (‘ask Copilot about this,’ shared prompts, etc.) deserve the same suspicion as any other unexpected link. If it’s not something your team relies on for work, there’s no downside to leaving Copilot signed out of business accounts.

The bigger picture

This is the third Copilot flaw Varonis has uncovered this year, and Microsoft took nearly eight months to fully close it after being told. AI assistants are being added to everyday software faster than they’re being secured, so it’s worth treating them as another app that needs oversight — not a black box you just trust. — Microsoft Copilot Personal Flaws Could Let One Click Exfiltrate Data From Connected Apps (The Hacker News)

Not sure what AI tools your team has quietly connected to business accounts? Book a free consult — https://micro1tech.com/contact/