Copilot Security: 3 Flaws Law Firms Can’t Ignore

August 21, 2026

Copilot security advisory alert displayed on an office computer monitor as an attorney in a suit reviews an elevated risk update by Cocha Technology.

If your firm rolled out Microsoft 365 Copilot and did one security review at launch, then moved on, this week’s news is the reason that approach doesn’t hold up. On August 18, Microsoft patched a Copilot vulnerability that Varonis Threat Labs calls CoSnitch, and the way it got discovered is almost stranger than the flaw itself. A single crafted link could pull data out of a user’s session, including passwords and content from connected apps, without so much as a second click to confirm anything.

Here’s the thing though. This isn’t the first Copilot flaw Varonis has found this year. It’s the third. And I think that pattern matters more than any single vulnerability, because it says something about what Copilot security requires going forward, and a one time setup task isn’t it.

What Varonis Found This Time

CoSnitch, tracked as CVE-2026-24301, targets Microsoft Copilot Personal, and it’s a textbook example of the kind of Copilot security gap that doesn’t show up in a standard rollout checklist. The mechanism is an undocumented URL parameter, “autorun,” that when paired with Copilot’s standard query parameter lets an attacker crafted prompt execute inside the victim’s own authenticated session. No confirmation dialog. No obvious warning sign. Just a link, a click, and Copilot quietly running a command it was never supposed to run on its own.

Once triggered, the attack could reach into whatever the session had access to. That includes connected services like Gmail, Google Drive, and Google Calendar, plus Copilot’s own memory and chat history, which is exactly where passwords and other sensitive strings tend to end up when people paste things into an AI assistant without thinking too hard about it. Varonis reported the issue to Microsoft in December 2025, and the patch shipped this week. The company says it found no evidence CoSnitch was exploited before the fix went out, which is the good news buried in all of this.

The Discovery Method Is Almost as Concerning as the Flaw

What stands out to me isn’t just the vulnerability. It’s how Varonis found it. Researchers didn’t reverse engineer the flaw from code. They asked Copilot about it directly, using a technique they’re calling meta-hacking. When Copilot insisted automatic prompt execution “wasn’t possible,” they kept rephrasing the question as a follow up, and Copilot’s own explanations eventually gave up the exact undocumented parameter that made the attack work.

Think about what that means for how you evaluate Copilot security going forward. The AI assistant leaked its own attack surface through ordinary conversation, no exploit tooling required. If a security researcher can get there by asking politely and persistently, that’s worth sitting with for a minute before assuming your firm’s Copilot security posture is solid just because nobody’s tried to break it yet.

This Is the Third Copilot Flaw This Year, Not the First

CoSnitch didn’t happen in isolation. Microsoft patched Reprompt, an earlier single click Copilot attack that bypassed guardrails just by asking twice, back in its January 2026 security updates. Then in June, Varonis disclosed SearchLeak, a related one click exfiltration chain against Copilot Enterprise Search, tracked as CVE-2026-42824 and rated critical. CoSnitch in August makes three in eight months, all from the same research team, all targeting some version of the same product line.

I don’t think that’s a coincidence and I don’t think it’s really about Microsoft being careless either. As The Hacker News reported when CoSnitch broke, Copilot is a genuinely large, fast moving attack surface, connected to email, files, calendars, and now a growing list of third party apps through OAuth. Three disclosed flaws in eight months from one research team probably means there are Copilot security findings from other researchers we haven’t heard about yet, or gaps nobody’s found. Either way, “we checked Copilot security at rollout” was already a thin claim in January. By August it’s not credible at all.

Why This Hits Different at a Law Firm

A lot of firms adopted Copilot specifically because it lives inside the Microsoft 365 environment they already trust, already have vendor agreements for, already understand from a compliance standpoint. That’s a reasonable starting point. Our own post on Copilot adoption for law firms covers why that trust is generally well placed. But trust in the platform and confidence in Copilot security on every feature Microsoft ships on top of it are two different things, and CoSnitch is a good example of where that gap shows up.

Copilot security questions land harder at a firm than at, say, a marketing agency, because of what’s flowing through the tool day to day. Matter data, privileged communications, client identifying information, all of it potentially touching Copilot the moment someone asks it to summarize a document or draft a memo.

Client confidentiality is the obvious concern. If a Copilot session can be manipulated into pulling data from connected apps, and your firm has connected Copilot to email, document storage, or calendar systems that touch matter data, you’ve got a plausible path from a single bad click to a disclosure event. Model rules around competence don’t require attorneys to be security experts, but they do require a reasonable understanding of the technology used to deliver legal services. A flaw that sat in responsible disclosure for the better part of eight months, discovered through the vendor’s own chatbot giving up the goods, is exactly the kind of thing a firm needs to be able to speak to if a client or a regulator ever asks.

The Governance Gap: Rollout Review vs. Ongoing Monitoring

Here’s where I want to push back a little on how most firms structure their Copilot security work. It tends to get treated as a launch checklist. Review permissions, set data loss prevention rules, train a few power users, done. That checklist approach made sense when Copilot was a static tool and Copilot security meant a single point in time review. It doesn’t anymore, because Microsoft ships changes to Copilot constantly, and so do the researchers finding new ways to break it.

We wrote a while back about why standard data loss prevention tools won’t fully protect agentic AI assistants like Copilot and Claude on their own, and this is a live example of exactly that gap. DLP policies are built to catch data leaving through known channels. CoSnitch didn’t need a known channel. It needed Copilot’s own session and a link. That’s not something a traditional DLP rule set is designed to see coming, which is why security controls built specifically for Microsoft 365 Copilot deployments matter more than generic data protection tooling bolted on after the fact.

The uncomfortable truth is that Copilot security isn’t a project with an end date. It’s closer to patch management for any other piece of critical infrastructure, except the vendor is shipping new capability into it every month and researchers are actively hunting for what breaks. Firms that treat it that way, ongoing rather than one and done, are the ones who’ll be ahead of the next CVE instead of reading about it after the fact.

A Practical Copilot Security Checklist for This Month

Confirm the patch landed. CVE-2026-24301 was patched August 18. If your firm runs Copilot Personal or has personal accounts connected through work devices, verify the fix applied rather than assuming automatic updates caught it.
Audit connected apps. Every OAuth connection between Copilot and an outside service, Gmail, Drive, Calendar, anything, is a potential path for exactly this kind of attack. Fewer connections means a smaller blast radius.
Revisit what lives in Copilot memory and chat history. If people are pasting passwords or client identifiers into Copilot conversations, that’s a training problem worth fixing regardless of this specific flaw.
Set a recurring Copilot security review, not a one-time review. Monthly is reasonable. Assign it to someone by name. Three disclosed flaws in eight months is not a pace that tolerates an annual check-in.
Ask your vendor or MSP how they track this. If a reseller manages your Copilot deployment, ask directly whether they monitor Varonis, Microsoft’s security advisories, and similar research on an ongoing basis, or whether that’s an assumption nobody’s confirmed. A vendor who can’t answer that is managing your Copilot licensing, not your Copilot security.

None of this requires a big budget. It requires someone owning Copilot security as a standing responsibility instead of a box checked at rollout.

Where This Fits the Bigger AI Governance Picture

This isn’t happening in a vacuum. Researchers and enterprises are documenting agentic AI security gaps across every major vendor this year, not just Microsoft, and law firms are squarely in the blast radius because so much of what they do lives in exactly the kind of connected, document heavy environment these attacks target. The pattern worth watching isn’t any single CVE. It’s how fast the disclosure cadence is picking up, and whether a firm’s own Copilot security monitoring keeps pace with it or falls further behind with each one.

Copilot Security: Frequently Asked Questions

What is CoSnitch, exactly?

CoSnitch is a Microsoft Copilot Personal vulnerability, tracked as CVE-2026-24301, disclosed by Varonis Threat Labs. It combined an undocumented URL parameter with Copilot’s standard query parameter to let a crafted link trigger prompt execution inside a victim’s authenticated session, without a confirmation click, reaching connected apps and Copilot’s own memory and chat history.

Has CoSnitch been exploited against real firms?

Varonis reported finding no evidence of exploitation before Microsoft’s August 18, 2026, patch shipped. The flaw was disclosed responsibly in December 2025 and fixed before going public.

Is this the first Copilot security flaw this year?

No. It’s the third disclosed by the same research team in 2026, after Reprompt in January and SearchLeak, tracked as CVE-2026-42824, in June. All three targeted different parts of the Copilot product line.

Does this mean law firms shouldn’t use Copilot?

Not necessarily. It means Copilot security needs to be treated as an ongoing monitoring responsibility rather than a task completed at rollout, especially for firms with Copilot connected to email, document storage, or other systems touching client matter data.

Who should be tracking Copilot vulnerability disclosures at a firm?

Someone with standing accountability for it, whether that’s IT leadership, a risk partner, or an outside partner explicitly asked to monitor vendor security advisories on a recurring basis. Assigning it by name is the difference between catching the next one quickly and finding out about it from a client.

The Bottom Line

CoSnitch got patched, and Varonis found no evidence it was used against anyone before the fix shipped. That’s the reassuring part. The less reassuring part is that this is the third Copilot flaw disclosed in eight months, discovered in part because a researcher just kept asking Copilot polite questions until it explained its own weak spot. A firm that reviewed Copilot security once at rollout and hasn’t looked since is running on assumptions that were already out of date by the time SearchLeak hit in June, let alone now.

If you want an honest look at where your firm’s Microsoft 365 environment stands against this kind of exposure right now, our Microsoft 365 Data Exposure Snapshot is built for exactly this, a focused look at what Copilot can already reach before it turns into an incident you find out about from a client instead of from us.

Steve Combs

Co-Founder & Managing Director, Cocha Technology

Steven is a fractional CIO/CISO with 30+ years of enterprise IT and security leadership. He has built AI governance frameworks for organizations with 1,700+ users, led enterprise Microsoft Copilot deployments, and conducted security assessments across law firms, energy companies, financial institutions, and PE-backed manufacturers.