CoSnitch. The access path.
One link ran a prompt inside a victim's Copilot session and poisoned its memory. Revoking the session is the standard answer. Here it left the implant in place.
The record
Entry point. crafted link, an autorun parameter made the prompt execute on page load, not merely prefill the box.
The identity in the middle. The victim OAuth connector grants inside Copilot for mail, calendar and Drive, plus the authenticated session the link rode. The poisoned memory survived password changes and session revocation.
What was reached. poisoned persistent memory that survives session revocation.
One link ran a prompt inside a victim's Copilot session and poisoned its memory.
The path, step by step.
Taken from the published reporting. Nothing here is reconstructed.
| Step | Role in the path | What the reporting records |
|---|---|---|
| crafted link | Entry | an autorun parameter made the prompt execute on page load, not merely prefill the box |
| authenticated session and connectors | Step | the prompt reads mail bodies, calendar, Drive metadata and chat history |
| URL summarisation feature | Step | the collected data is base64 encoded into a URL Copilot fetches |
| attacker webhook | Step | the request looks like routine Copilot activity in monitoring |
| persistent memory | Reached | a poisoned entry survives password changes and session revocation |
Where a breakpoint would have been
The memory write, because it is the only step that outlives the session. Everything before it is a bad day; a persistent entry that survives credential rotation turns one click into standing access. Agent memory needs the same review cycle as a grant.
A breakpoint is the single change that closes a path with the least disruption. Read how that is chosen in the breakpoint page.
5 steps from entry to data.
Where this comes from.
Every field on this page is taken from the published reporting below. The breakpoint assessment is Elmoz reading that path, not a statement about what the affected organisation did.
Varonis Threat Labs · MITRE CVE record, CVE-2026-24301 · The Hacker News
Questions, answered.
The two questions this record answers.
What was the entry point in the CoSnitch incident?
The published path starts at crafted link, an autorun parameter made the prompt execute on page load, not merely prefill the box.
What did it reach?
The published path ends at poisoned persistent memory that survives session revocation.
Other incidents.
Same database, different path shape.
See what your agents can reach. Before someone else does.
Book a demo and we walk through the access paths in an environment like yours.