Microsoft Copilot Personal Flaws Could Let One Click Exfiltrate Data From Connected Apps

Researchers at Varonis Threat Labs have identified three vulnerabilities in Microsoft Copilot Personal, which they refer to as CoSnitch. These flaws could potentially allow an attacker to extract data from connected apps and other information available in a Copilot session with just one click on a malicious link. The vulnerabilities exploit an undocumented URL parameter that is exposed by the assistant itself. This could enable silent data exfiltration, posing a risk to users. The discovery highlights a potential security risk in Microsoft Copilot Personal.