CoSnitchはCopilotのメールと予定を盗む3脆弱性、修正済み

"Varonis Threat Labs uncovered another one-click vulnerability in Microsoft Copilot Personal dubbed CoSnitch (critical, CVE-2026-24301), which quietly executes an attack chain that exfiltrates data from enterprises without obvious red flags."（冒頭）／"Automatic prompt execution: The ?q= URL parameter combined with an undocumented parameter causes any attacker-supplied prompt to execute instantly on page load: no click, no confirmation, no user action. One link is all it takes."／"Data exfiltration to external servers: An injected prompt can query the victim's connected apps (Gmail, Drive, Calendar, OneDrive), encode the results into a URL, and exfiltrate them via Copilot's built-in URL-fetch capability to an attacker-controlled webhook."／"Persistent memory poisoning via web summarization: A crafted webpage, when summarized by Copilot, injects attacker instructions into the victim's permanent memory store. The injection survives password changes, session revocation, and device re-enrollment, persisting forever."（The vulnerabilities behind CoSnitch 節）— Varonis Threat Labs より

"CoSnitch is the third Microsoft Copilot flaw Varonis Threat Labs has discovered this year. Reprompt bypassed Copilot's guardrails just by asking twice. SearchLeak turned Microsoft 365 Copilot Enterprise into a silent exfiltration tool. All three share the same pattern: one click on a legitimate-looking link is enough."／"Varonis disclosed CoSnitch to Microsoft in December 2025, and patches were shipped on August 18, 2026. Varonis has seen no evidence that the attack has been exploited in the wild, and thanks Microsoft for their collaboration on the fix."（冒頭）— Varonis Threat Labs より

"Our researchers didn't have to reverse-engineer the flaw. The AI exposed the weakness during normal use"／"When we first asked Copilot how to execute a prompt without user interaction automatically, it explained that’s not how it works, user intent is required, and prompts don’t fire on their own."／"Instead of settling for that standard response, we deliberately kept pushing by reframing each question to seem like a natural follow-up rather than a probe. We asked about URL structure, deep links, and what happens when a page is loaded with input already in the field with the intent to make Copilot reason one layer deeper about its own architecture. Every answer narrowed our search. This is called meta-hacking, aka social engineering the reasoning engine itself. The resistance is part of the technique."／"You don’t exploit the model. You manipulate it into cooperating."（Meta-hacking 節）— Varonis Threat Labs より

"Once execution is triggered, the prompt has the same capabilities as any legitimate user instruction."／"Copilot then disclosed an undocumented URL parameter — unprompted, mid-refusal — including its historical behavior and every protection put in place to disable it"／"We built the URL exactly as described. With no click or confirmation from the user, the prompt was successfully executed automatically"／"Note: ?q= alone only pre-fills the input the user would still need to press Enter. It is ?autorun=1 that enables automatic execution on page load. Both parameters must be present for the attack to work silently."（The steps behind meta-hacking ／ Vulnerability 1 節）— Varonis Threat Labs より

"the prompt instructs Copilot to encode the collected data into a URL path and fetch it"／"The base64 encoding compresses the payload into a URL-safe string and helps avoid triggering content filters that scan for sensitive patterns, such as passwords or API keys, in outbound requests."／"For multi-source exfiltration, retrieved content is concatenated into a single encoded payload"／"Email content, subject lines, sender/recipient metadata, message bodies"／"Google Calendar Meeting titles, attendees, times, and locations"／"Google Drive File names, metadata summaries"／"Copilot Chat History Full prior conversation content"／"Copilot Memory Persistent cross-session context, saved instructions, user-defined rules"／"Once Copilot has OAuth access to a user’s Gmail account, it can read everything in that inbox, not summaries, not metadata, but full message bodies. In our testing, this included emails containing credentials shared over email, internal system passwords, password reset links, and sensitive personal information that users had never considered at risk because it was “just in email.”"／"From the network layer, this is a standard outbound HTTPS GET request, identical to any legitimate URL fetch Copilot performs when summarizing a webpage. No anomalous headers, no unusual ports, no flaggable payload. Security tooling sees Copilot doing exactly what it always does: fetching a URL."（Vulnerability 2 節／上表の各行は同節の Data exfiltrated in testing 表の該当セルに対応し、引用は1セルずつ切り出している）— Varonis Threat Labs より

"No forensic footprint: The memory write produces no process, file, network connection, or log entry that security tooling would flag. The only record is in Copilot’s memory UI, which users rarely inspect"／"The victim clicks the attacker’s crafted URL (delivered via email, chat, phishing page, QR code, etc.)"／"Copilot does not distinguish between content to summarize and instructions to follow when processing external page content. If the page contains natural language instructions formatted in a way the model interprets as directives, those instructions execute."／"Once the memory is written, the attacker’s instructions are permanent. Copilot’s memory has no expiration. It does not reset between sessions and does not clear on logout, and is never automatically deleted or overwritten. The injected instruction remains active in every future Copilot conversation for that user unless the user manually navigates to the memory settings and deletes it. Most users never do this, with many users not even knowing it exists."（Vulnerability 3 ／ Impact 節。QRコードの断片のみ Vulnerability 1: Automatic prompt execution 節）— Varonis Threat Labs より

"CoSnitch is three vulnerabilities, one click, and zero anomalous signals. Each vulnerability poses a serious risk on its own. Chained together, they turn a single click into a silent data-theft tool by exploiting the trust model at the heart of modern AI connectivity, not by breaking anything."／"The novel meta-hacking technique that uncovered CoSnitch — using the AI’s own reasoning to surface its hidden internals — applies to any agentic platform with a natural language interface."（The bottom line 節）— Varonis Threat Labs より