{"vulnerability": "cve-2026-24301", "sightings": [{"uuid": "49de144d-0a97-4906-9b62-2c1618fd8a3d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-24301", "type": "seen", "source": "https://bsky.app/profile/aibearnews.bsky.social/post/3mtiogf6yis23", "content": "\ud83d\udd12 Microsoft Copilot \u00e8 stato hackerato... dai suoi stessi ricercatori\nUna vulnerabilit\u00e0 (CVE-2026-24301, CVSS 8.8) permetteva di rubare Gmail, Drive e Calendar con un solo click. Scoperta con una tecnica bizzarra: i ricercatori hanno chiesto a Copilot perch\u00e9 l'attacco fosse impossibile, e...", "creation_timestamp": "2026-08-20T07:02:01.742156Z"}, {"uuid": "1ca475c9-29d8-405e-9b71-fb0e1cee8603", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-24301", "type": "seen", "source": "https://bsky.app/profile/crustytldr.bsky.social/post/3mtgvufr3d72c", "content": "\ud83d\udd12 CVE-2026-24301: \"CoSnitch\" vulnerability in Microsoft Copilot\n\nA severe \"CoSnitch\" vulnerability (CVE-2026-24301) in Microsoft Copilot Personal allowed attackers to silently sipho...\n\nhttps://tinyurl.com/27yuyjyg #CyberSecurity #InfoSec #CrustyTLDR", "creation_timestamp": "2026-08-19T14:09:48.537162Z"}, {"uuid": "f6a9d5bd-8354-4b40-959a-5afe27f245b0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-24301", "type": "seen", "source": "https://bsky.app/profile/fireuppro.bsky.social/post/3mtkuo3szdc2c", "content": "CVE-2026-24301 (CoSnitch): Microsoft Copilot had a hidden autorun parameter that silently exfiltrated emails, calendar data and Drive files for 8 months\n\n#Microsoft #CoPilot", "creation_timestamp": "2026-08-21T03:59:05.036357Z"}, {"uuid": "70ae2545-1026-43e3-ba30-eac0621e92fa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-24301", "type": "seen", "source": "https://bsky.app/profile/yayafa.bsky.social/post/3mth6bdvma62w", "content": "Microsoft Copilot Personal\u306b\u8106\u5f31\u6027\u3001\u9023\u643a\u30a2\u30d7\u30ea\u304b\u3089\u30ef\u30f3\u30af\u30ea\u30c3\u30af\u3067\u30c7\u30fc\u30bf\u3092\u6d41\u51fa\u3055\u305b\u308b\u6050\u308c\uff08CVE-2026-24301\uff09 | Codebook\uff5cSecurity News\n\nhttps://www.yayafa.com/2868613/\n\nMicrosoft Copilot \u2026", "creation_timestamp": "2026-08-19T16:40:13.458956Z"}, {"uuid": "709ba7ef-9723-4258-90f6-f796c7b31f1f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-24301", "type": "seen", "source": "https://infosec.exchange/users/AAKL/statuses/117117540428017104", "content": "Microsoft has an advisory for a new critical Copilot vulnerability.\nCRITICAL: CVE-2026-24301: Microsoft Copilot Information Disclosure Vulnerability https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-24301\nMore information:\nCWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') https://cwe.mitre.org/data/definitions/77.html #infosec #Microsoft #Copilot #vulnerability", "creation_timestamp": "2026-08-18T16:50:47.362238Z"}, {"uuid": "9d81569c-fd08-45ff-b931-4f8de97f70bc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-24301", "type": "seen", "source": "https://bsky.app/profile/theitnerd.ca/post/3mthbsludxl2b", "content": "Researchers got Microsoft Copilot to explain its own security bypass just by asking it the right follow-up\u00a0questions\n\nVaronis Threat Labs disclosed CoSnitch (CVE-2026-24301), a critical\u00a0flaw\u00a0in Microsoft Copilot Personal made of three chained weaknesses that let an attacker exfiltrate data from a\u2026", "creation_timestamp": "2026-08-19T17:43:32.838839Z"}, {"uuid": "e938b9ee-1d29-40e9-99d5-7f11210af12d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-24301", "type": "seen", "source": "https://bsky.app/profile/andercoleai.bsky.social/post/3mtlp7zmkas2l", "content": "A critical Copilot Personal flaw (CoSnitch, CVE-2026-24301) let one clicked link silently pull data from connected Gmail, Drive, and Calendar accounts, no confirmation needed. \n\nmedium.com/@andarcole88...", "creation_timestamp": "2026-08-21T11:54:24.892725Z"}, {"uuid": "13803e47-13d9-4530-a558-21ab64015acf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-24301", "type": "seen", "source": "https://bsky.app/profile/newsfacts.bsky.social/post/3mtfqh6zemb2q", "content": "Varonis ontdekt nieuwe \u2018CoSnitch\u2019 kwetsbaarheid in Microsoft Copilot die datadie\n\nVaronis Threat Labs heeft een ernstige kwetsbaarheid ontdekt in Microsoft Copilot Personal, genaamd CoSnitch (CVE-2026-24301). Deze kwetsbaarheid stelt aanvallers in staat om met slechts \u00e9\u00e9n klik op een kwaadaa...", "creation_timestamp": "2026-08-19T03:00:20.230437Z"}, {"uuid": "b5f7aabc-d7c8-4b32-9b9c-215d85fd36d0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-24301", "type": "seen", "source": "https://bsky.app/profile/blackhatnews.tokyo/post/3mtfzibvdch2u", "content": "CoSnitch:Microsoft Copilot\u306e\u8106\u5f31\u6027\u30011\u56de\u306e\u30af\u30ea\u30c3\u30af\u3067\u30c7\u30fc\u30bf\u304c\u5bc6\u304b\u306b\u76d7\u307e\u308c\u308b\u6050\u308c\n\nMicrosoft Copilot Personal\u306b\u5b58\u5728\u3059\u308b\u91cd\u5927\u306a\u8106\u5f31\u6027(CVE-2026-24301\u3001\u901a\u79f0\u300cCoSnitch\u300d)\u306b\u3088\u308a\u3001\u653b\u6483\u8005\u304c\u60aa\u610f\u3042\u308b\u30ea\u30f3\u30af\u3092\u88ab\u5bb3\u8005\u306b\u30af\u30ea\u30c3\u30af\u3055\u305b\u308b\u3060\u3051\u3067\u3001\u9023\u643a\u3055\u308c\u305f\u30a2\u30ab\u30a6\u30f3\u30c8\u304b\u3089\u6a5f\u5bc6\u60c5\u5831\u3092\u5bc6\u304b\u306b\u76d7\u307f\u51fa\u305b\u308b\u53ef\u80fd\u6027\u304c\u3042\u308b\u3053\u3068\u304c\u5206\u304b\u308a\u307e\u3057\u305f\u3002 Microsoft\u306f\u3001Varonis T...", "creation_timestamp": "2026-08-19T05:41:57.179182Z"}, {"uuid": "f0736d14-6f73-4fbb-9ea7-b89d721ea7a8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-24301", "type": "seen", "source": "https://bsky.app/profile/shiojiri.com/post/3mtg5g6ykacya", "content": "Microsoft Copilot Personal\u306b\u8106\u5f31\u6027\u3001\u9023\u643a\u30a2\u30d7\u30ea\u304b\u3089\u30ef\u30f3\u30af\u30ea\u30c3\u30af\u3067\u30c7\u30fc\u30bf\u3092\u6d41\u51fa\u3055\u305b\u308b\u6050\u308c\uff08CVE-2026-24301\uff09 | Codebook\uff5cSecurity News https://codebook.machinarecord.com/threatreport/silobreaker-cyber-alert/47254/", "creation_timestamp": "2026-08-19T06:52:23.277658Z"}, {"uuid": "880604ac-497c-4d37-9694-bb4403a513e5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-24301", "type": "seen", "source": "https://gist.github.com/cyberupdates365/2162e9f0da3d970a21147d1c28caaaf8", "content": "# Critical Microsoft Copilot CoSnitch Vulnerability CVE-2026-24301 Explained\n\nDiscover how the critical microsoft copilot cosnitch vulnerability cve-2026-24301 allowed attackers to steal sensitive data with a single click using meta-hacking.\n\nA severe security flaw tracked as the microsoft copilot cosnitch vulnerability cve-2026-24301 has exposed the hidden risks of connecting third-party applications to personal AI assistants. Discovered by researchers at Varonis Threat Labs, this vulnerability allowed attackers to silently siphon sensitive data from a victim's connected accounts (such as Gmail and Google Drive) with just a single click on a malicious link.\n\nMicrosoft officially patched the vulnerability in Copilot Personal on August 18, 2026. The vulnerability was not a traditional buffer overflow; it was a sophisticated chain of prompt injection and command injection leveraging an undocumented URL parameter (`autorun=1`).\n\n\ud83d\udd17 **[Read the Full Technical Breakdown and Mitigation Steps on CyberUpdates365](https://cyberupdates365.com/copilot-cosnitch-cve-2026-24301/)**", "creation_timestamp": "2026-08-19T08:39:55.037417Z"}, {"uuid": "28f7a258-460e-425d-a670-058e8c30ba40", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-24301", "type": "seen", "source": "https://bsky.app/profile/shopkeyonline.bsky.social/post/3mttv4kreq62b", "content": "One click on a Copilot link is all it takes. The CoSnitch flaw (CVE-2026-24301) lets attackers silently pull emails, files, and calendar data from your connected apps \u2014 no warning, no second click. Shop Key Online breaks down what happened and how to stay safe \ud83d\udd12", "creation_timestamp": "2026-08-24T18:01:05.820145Z"}, {"uuid": "29af31a3-b95a-40a7-a621-c5ed783cf8ac", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-24301", "type": "seen", "source": "https://t.me/bhhub/1213", "content": "Weekly 8 AI & Cyber signals to act on (Aug 17\u201324, 2026)\n\n#AISecurity@bhhub\n\n\u2728 KeyPooling finds shared LLM cache identity. AI inference caches can cross tenant boundaries when gateways share upstream credentials: five tested gateways exposed cross-customer reads, and one controlled route recovered 16 bits in 128 victim-path requests. Bind cache keys to authenticated tenants; the paper estimates post-prefix isolation at 1.7\u20132.5% extra cost, but does not estimate real-world prevalence.\n\n\u2728 MaliciousSkillBench breaks scanner confidence. AI-agent skill defenses that scored up to .932 Macro-F1 on random splits fell to .653\u2013.665 on unseen sources across a 9,740-sample benchmark. One model kept 95.6% malicious recall only by flagging 62.4% of benign skills; validate scanners source-disjoint and budget for false positives.\n\n\u2728 LeakGauge spots context extraction before decoding. An LLM\u2019s own prefill probabilities reveal system-prompt and RAG leakage attempts: across 11 open models, unseen-attack AUROC was .944\u2013.996, with under 500 probe parameters and 10.34 ms added latency. A known single probe was evaded, so deployments need diverse probes; unrestricted adaptive robustness is unproven.\n\n\u2728 AID-Guard binds one approval to one effect. For tool-using AI agents, approval must survive retries, crashes and ambiguous provider results: a prototype blocked 44/44 compromised-proposer attacks and produced no duplicates across 290 Stripe, successor, race and recovery trials. The exact policy cut benign utility by 35.4\u201343.8 points, making safer typed profiles the research problem.\n\n#AppSec@bhhub\n\n\u2728 ARQ teaches agents to repair CodeQL. An execution-grounded LLM agent improved 12 official C/C++ queries, raised FormAI true positives by up to 119.8% at \u226598% precision, fixed three long-open CodeQL issues, and found two new zlib/libpng bugs. Pure-LLM editing regressed in five of six settings: generated witness programs are the critical feedback loop.\n\n#RedTeam@bhhub\n\n\u2728 CoSnitch makes Copilot leak via one link. Copilot\u2019s prompt autorun, connectors, fetch and persistent memory formed an AI-specific exfiltration chain: after a victim opened a crafted link, researchers read connected data and planted memory that survived password reset. Microsoft patched CVE-2026-24301 (CVSS 8.8); Varonis reports no in-the-wild exploitation.\n\n#BlueTeam@bhhub\n\n\u2728 ClawSentry guards the full agent lifecycle. Monitoring AI skills from admission through post-action effect cut contextual attack success on Codex/GPT-5.4 from 39.55% to 2.61% with task success nearly flat, and reduced attacks across five agents to 9.09\u201315.03%. Poisoned-package utility still fell and clean false blocks reached 5.7\u20137.5% in stress tests.\n\n\u2728 CTIFoundry makes small AI investigators beat a flagship. A typed CTI graph, narrow tools and procedural skills lifted agent F1 from .610 to .829 for GPT-5.4 and .470 to .745 for Claude Haiku; a 2\u00d72 ablation isolated super-additive gains from structure plus procedure. Code is not public yet, and attribution still needs human review.", "creation_timestamp": "2026-08-25T00:00:24.643263Z"}, {"uuid": "a5328ffb-eb41-4f99-91c6-e5cb0efc8a97", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-24301", "type": "seen", "source": "https://bsky.app/profile/Takita.mastodon.social.ap.brid.gy/post/3mu5uk4dklpe2", "content": "\u26a1 Jedno klikni\u0119cie wystarczy\u0142o, aby Copilot wys\u0142a\u0142 twoje maile hakerom\u26a1\n\ud83d\udc49 https://wykop.pl/link/8002385/jedno-klikniecie-wystarczylo-aby-copilot-wyslal-twoje-maile-hakerom\nBadacze Varonis znale\u017ali w Microsoft Copilot luk\u0119 CVE-2026-24301, kt\u00f3r\u0105 wystarczy\u0142o [\u2026] \n\n[Original post on mastodon.social]", "creation_timestamp": "2026-08-28T17:17:25.219189Z"}, {"uuid": "d6111f4f-8d95-49a4-bd13-f1bf31202888", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-24301", "type": "seen", "source": "https://t.me/bhhub/1213", "content": "Weekly 8 AI & Cyber signals to act on (Aug 17\u201324, 2026)\n\n#AISecurity@bhhub\n\n\u2728 KeyPooling finds shared LLM cache identity. AI inference caches can cross tenant boundaries when gateways share upstream credentials: five tested gateways exposed cross-customer reads, and one controlled route recovered 16 bits in 128 victim-path requests. Bind cache keys to authenticated tenants; the paper estimates post-prefix isolation at 1.7\u20132.5% extra cost, but does not estimate real-world prevalence.\n\n\u2728 MaliciousSkillBench breaks scanner confidence. AI-agent skill defenses that scored up to .932 Macro-F1 on random splits fell to .653\u2013.665 on unseen sources across a 9,740-sample benchmark. One model kept 95.6% malicious recall only by flagging 62.4% of benign skills; validate scanners source-disjoint and budget for false positives.\n\n\u2728 LeakGauge spots context extraction before decoding. An LLM\u2019s own prefill probabilities reveal system-prompt and RAG leakage attempts: across 11 open models, unseen-attack AUROC was .944\u2013.996, with under 500 probe parameters and 10.34 ms added latency. A known single probe was evaded, so deployments need diverse probes; unrestricted adaptive robustness is unproven.\n\n\u2728 AID-Guard binds one approval to one effect. For tool-using AI agents, approval must survive retries, crashes and ambiguous provider results: a prototype blocked 44/44 compromised-proposer attacks and produced no duplicates across 290 Stripe, successor, race and recovery trials. The exact policy cut benign utility by 35.4\u201343.8 points, making safer typed profiles the research problem.\n\n#AppSec@bhhub\n\n\u2728 ARQ teaches agents to repair CodeQL. An execution-grounded LLM agent improved 12 official C/C++ queries, raised FormAI true positives by up to 119.8% at \u226598% precision, fixed three long-open CodeQL issues, and found two new zlib/libpng bugs. Pure-LLM editing regressed in five of six settings: generated witness programs are the critical feedback loop.\n\n#RedTeam@bhhub\n\n\u2728 CoSnitch makes Copilot leak via one link. Copilot\u2019s prompt autorun, connectors, fetch and persistent memory formed an AI-specific exfiltration chain: after a victim opened a crafted link, researchers read connected data and planted memory that survived password reset. Microsoft patched CVE-2026-24301 (CVSS 8.8); Varonis reports no in-the-wild exploitation.\n\n#BlueTeam@bhhub\n\n\u2728 ClawSentry guards the full agent lifecycle. Monitoring AI skills from admission through post-action effect cut contextual attack success on Codex/GPT-5.4 from 39.55% to 2.61% with task success nearly flat, and reduced attacks across five agents to 9.09\u201315.03%. Poisoned-package utility still fell and clean false blocks reached 5.7\u20137.5% in stress tests.\n\n\u2728 CTIFoundry makes small AI investigators beat a flagship. A typed CTI graph, narrow tools and procedural skills lifted agent F1 from .610 to .829 for GPT-5.4 and .470 to .745 for Claude Haiku; a 2\u00d72 ablation isolated super-additive gains from structure plus procedure. Code is not public yet, and attribution still needs human review.", "creation_timestamp": "2026-08-24T09:00:04.739377Z"}]}