Microsoft Copilot Personal Flaws Could Let One Click Exfiltrate Data From Connected Apps

Varonis Threat Labs discovered three vulnerabilities, collectively named ‘CoSnitch,’ in Microsoft Copilot Personal that could allow a single click on a crafted link to silently exfiltrate data from connected apps. The flaws enable an attacker to inject commands and steal sensitive information like email content, calendar details, and file metadata. While Microsoft has patched the issue, Varonis recommends reviewing connected apps and exercising caution with links to AI assistants due to the persistence of injected memories and the difficulty in detection.