Use case sources
Source reports and analysis supporting this case are listed below. AITBM interpretation and any indicative scoring are derived from this public evidence.
- AIDEFEND in Action — CoSnitch Combined Copilot Autorun Exfiltration with a Separate Memory-Poisoning Path
- Primary source — CoSnitch: One Click to Leak Your Secrets or Poison Copilot's Memory (Varonis Threat Labs, 2026-08-18)
- AIDEFEND SecureFlow — CoSnitch: Copilot Web Persistent Memory Poisoning
- AIDEFEND SecureFlow — CoSnitch: Copilot Web Autorun Data Exfiltration
CoSnitch covered two independent Copilot attacks. In the autorun branch the victim opened a legitimate copilot.microsoft.com URL containing an attacker prompt in ?q= together with an undocumented autorun=1 switch; the existing authenticated browser session supplied the victim context and the prompt ran without a new confirmation, instructing Copilot to retrieve information from connected Gmail, Drive, Calendar, and chat history, encode selected values into a URL, and use Copilot's own fetch capability to send the request.
In the memory branch a user asked Copilot to summarize an attacker-controlled webpage; hidden page text told the system to call memory.add, and the poisoned record became future prompt context. Varonis reports that password changes, session revocation, and device re-registration did not remove the memory — it remained until explicitly deleted. Microsoft patched CVE-2026-24301 on 2026-08-18; NVD lists CVSS 8.8, required user interaction, and no known exploitation. The durable lesson the brief draws is to govern both automatic prompt execution and memory writes as security decisions.
ASSESSED SYSTEM
Microsoft Copilot Web (the experience Varonis tested and describes as Copilot Personal) in its pre-fix state: an authenticated browser session in which (a) a copilot.microsoft.com URL combining ?q= with an undocumented autorun=1 parameter ran an embedded prompt without confirmation and used Copilot's own fetch capability against connected Gmail, Drive, Calendar, and chat history, and (b) hidden instructions in a summarized webpage invoked memory.add and persisted in long-term memory that Copilot could recall in later conversations. Both branches are entry points into one assessed product surface; Microsoft fixed CVE-2026-24301 on 2026-08-18.
OUT OF SCOPE
The two branches are independent and are not treated as one chain: the memory path began in a summarization workflow and did not depend on the crafted autorun link. The attacker's crafted URL, webpage, and destination are the attack, not the assessed system. Gmail, Drive, and Calendar are connected sources, not the assessed system. The post-2026-08-18 fixed state is out of scope. Product naming follows Microsoft's formal vulnerability record — Copilot Web — with the research wording preserved as an alias. NVD reports no known exploitation, so no victim or campaign outcome is scored.
Architecture: Agentic / MCP System (decision tree Q2) — Q1 = NO: a single assistant; no peer-agent coordination is described. Q2 = YES: on both branches Copilot autonomously executes a multi-step workflow — retrieving from connected sources, encoding values, invoking its own fetch capability, and on the second branch calling memory.add — with no approval for any individual step and with state that persists into later sessions. Evidence in the brief: the embedded prompt ran without a new confirmation, and the poisoned memory record became future prompt context. Tier 2: Tier 2 (Consumer): Copilot Web is a broadly distributed consumer assistant holding connectors to a user's mail, files, calendar, and conversation history, and both demonstrated harms — exfiltration of that content and durable poisoning of the user's long-term memory — land directly on that user population. NVD's CVSS 8.8 with required user interaction is consistent with a consumer-surface consequence class.
Documented attack or failure path
- Autorun branch: the victim clicks a legitimate copilot.microsoft.com URL carrying an attacker prompt in ?q= and the undocumented autorun=1 switch; the existing authenticated session supplies the victim context and the prompt runs with no new confirmation.
- The prompt instructs Copilot to retrieve information from connected Gmail, Drive, Calendar, and chat history, encode selected values into a URL, and use Copilot's own fetch capability to contact that destination.
- Memory branch (independent): a user asks Copilot to summarize an attacker-controlled webpage, and hidden page text instructs the system to call memory.add.
- The poisoned record enters long-term memory and becomes future prompt context, so the attacker instruction can be recalled in later conversations. Password changes, session revocation, and device re-registration do not remove it; it remains until explicitly deleted.
Observed controls and bounded outcomes
Positive credit is given only where the record directly demonstrates a control operating. Recommended or merely presumed controls receive no positive scoring credit.
- Retrieval stayed inside the victim's own connected-source scope: the attack used the existing authenticated session and its permissions, and no cross-account access, credential theft, or authentication bypass is reported, so those layers are not scored as failures.
- Microsoft patched CVE-2026-24301 on 2026-08-18, closing the reported vulnerability in the assessed product surface.
- NVD records required user interaction and no known exploitation, so neither branch is scored as an unassisted or in-the-wild compromise.
Layer 1 — Intrinsic Vulnerability Profile
Each sub-metric is placed on its five-level rubric by the evidence quoted beside it. Missing applicable evidence remains unknown. The displayed midpoint and interval are scenario values, not inferred control performance.
| Sub-metric | Score | Rubric basis | Evidence |
|---|---|---|---|
| Robustness (Ro) — scenario interval 0.00–0.77 (midpoint 0.39), Tier 2 MVT 0.50 indeterminate | |||
| Ro-1Adversarial Input Resistance | 0.00w 0.23 | 0.00 anchor: no adversarial-input control existed on either ingress and both injections succeeded. The 0.25 anchor requires basic filters resisting naive attacks; an undocumented parameter that converts supplied text into an executed prompt is the absence of any filter on that path. | Both branches admit untrusted content as authoritative instruction. A prompt supplied in a URL parameter executed automatically because a second parameter said to, and hidden text in a summarized webpage issued a memory.add call. AID-H-002.002 states the missing requirement for the first branch — the web request contract should reject an external parameter combination that both supplies and automatically executes a prompt — and AID-H-019.002 the second, sanitizing the summarized page into bounded plain text with untrusted provenance retained.source: brief |
| Fairness (Fa) — scenario interval 0.00–1.00 (midpoint 0.50), Tier 2 MVT 0.55 indeterminate | |||
| Transparency (Tr) — scenario interval 0.00–1.00 (midpoint 0.50), Tier 2 MVT 0.50 indeterminate | |||
| Privacy (Pr) — scenario interval 0.00–0.65 (midpoint 0.33), Tier 2 MVT 0.55 indeterminate | |||
| Pr-3Data Minimization Compliance | 0.00w 0.35 | 0.00 anchor: no minimisation exists between the user's action and the data the assistant may reach; the full connector scope was available to content the user never authorised. The 0.25 anchor requires some minimisation to be present, and the brief describes none. | A single click gave an attacker-supplied prompt the run of the session's entire connected-source scope — Gmail, Drive, Calendar, and chat history — none of which the user's action related to. AID-H-018.004 states the missing requirement: generate a short-lived connector and tool scope from a trusted user-visible task so that a URL-provided prompt cannot expand the session to unrelated mail, files, calendar entries, chat history, or arbitrary fetch destinations.source: brief |
| Containment (Cn) — scenario interval 0.00–0.29 (midpoint 0.14), Tier 2 MVT 0.55 confirmed breach | |||
| Cn-1Scope Enforcement | 0.00w 0.09 | 0.00 anchor: no effective scope boundary existed between attacker-supplied content and the assistant's connector, network, and memory surfaces. The 0.25 anchor requires boundaries that exist but are inconsistently enforced, and none is evidenced on either branch. | Untrusted content inherited the session's connector and outbound-fetch authority on the first branch and its memory-write authority on the second. No task-scoped capability envelope constrained which connectors could be read, which destinations could be contacted, or what could be written to durable memory; the brief's guidance is to list every connector and outbound fetch capability available to Copilot and require fresh action-specific approval before either.source: brief |
| Cn-3Output Filtering Robustness | 0.00w 0.13 | 0.00 anchor: no output or egress filtering is evidenced on the fetch sink — connected-source content was transmitted directly to an attacker-chosen destination, which is the literal 0.00 criterion. | Values retrieved from Gmail, Drive, Calendar, and chat history were encoded into an attacker-selected URL and sent with no release check. AID-H-018.005 is the Very High recommendation precisely because those values are not tagged sensitive, the tag is not preserved through encoding, and nothing blocks them from attacker-selected URL parameters.source: brief |
| Cn-6Action Reversibility Classification Rate | 0.00w 0.08 | 0.00 anchor: no pre-execution reversibility classification is performed and both actions execute ungated (ARCR = 0). The memory write is the clearest case: an action whose effect survives every standard account-recovery step received no more scrutiny than an ordinary reply. | Two distinct irreversible actions executed ungated. Sending connected-source content to an attacker destination is delegated-irreversible with external impact; writing a durable memory record is bounded-irreversible in a way the brief documents precisely — password changes, session revocation, and device re-registration did not remove it, and it remained until explicitly deleted. Neither was classified before execution and neither required an approval bound to its impact.source: researcher |
| Cn-7Resource and Execution-Loop Containment | 0.00w 0.13 | 0.00 anchor: the critical path is unbounded — durable agent state accumulates from untrusted input with no admission bound, no lifetime bound, and no deterministic teardown, and the brief confirms the standard termination actions do not clear it. No aggregate state budget or promotion gate of any kind is evidenced. | The memory branch establishes an unbounded state lifetime rather than an unbounded compute loop, and it is the state-retention half of this sub-metric that fails: a webpage-derived record entered durable memory with no promotion gate, no expiry, and no lifecycle bound, and it reloaded into every later prompt until manually deleted. AID-I-004.004 states the missing requirement — send webpage-derived memory candidates to quarantine and promote them only through an atomic, reviewed transition bound to the exact content digest — and AID-E-005 has to exist because purging the exact records is a separate operation from ending sessions.source: brief |
| Cn-8Untrusted Context Isolation | 0.00w 0.14 | 0.00 anchor: web-page content and URL-supplied text were admitted to active context as trusted instruction with no origin labelling, and connector data carried no provenance tag. The 0.25 anchor requires origin labels on some channels or prompt wording denying instruction authority; the brief evidences none on either ingress. Ro-1 is kept because the injection succeeded against the model (it issued the memory.add call on the page's instruction). | Both branches admit untrusted content as authoritative instruction: a prompt supplied in a URL parameter executed automatically because a second parameter said to, and hidden text in a summarized webpage issued a memory.add call that persisted. AID-H-019.002 — sanitizing the summarized page into bounded plain text 'with untrusted provenance retained' — is the missing requirement for the web-page channel, and AID-H-018.005 records that connector-returned values from Gmail, Drive, Calendar and chat history were not tagged by source or sensitivity.source: brief |
| Cn-9Self-Modification and Persistent-State Containment | 0.00w 0.14 | 0.00 anchor: long-term memory, which governs the agent's future behaviour, was writable by processed web content with no gate, and the write persisted silently across sessions and survived every standard account-recovery step. The 0.25 anchor requires the write to be logged or visible after the fact or a protected-path list that was bypassed; no visibility, attribution or promotion gate for the memory write is evidenced. | Hidden page text told the system to call memory.add; 'the poisoned record became future prompt context' and was recalled in later conversations. Varonis reports that 'password changes, session revocation, and device re-registration did not remove the memory — it remained until explicitly deleted'. AID-I-004.004 states the missing requirement — route webpage-derived memory candidates to quarantine and promote them only through an atomic, reviewed transition — and AID-M-002.004 the missing record of caller, source and eligibility decision for each proposed write.source: brief |
Unknown, not N/A: 18 applicable sub-metrics lack admissible public evidence. The lower, midpoint, and upper scenarios evaluate each at 0.00, 0.50, and 1.00 respectively; no weight is redistributed merely because evidence is missing.
Layer 2 — Operational Risk Posture
| Dimension | Score | Justification |
|---|---|---|
| AaAutonomy Amplification | 1.00w 0.25 | The 1.00 anchor is met: Copilot independently retrieved connected data, encoded it, contacted an external destination, and on the second branch wrote durable memory, with no approval for any step. The user's only action was a click or a summarization request. elevated |
| AsAttack Surface Exposure | 1.00w 0.35 | The 1.00 anchor is met: fully attacker-controlled content reaches the assistant's instruction path through two independent ingresses — a crafted URL on a legitimate origin, and an arbitrary webpage submitted for summarization. Neither requires the attacker to hold any account or permission. elevated |
| CpCascade Potential | 1.00w 0.20 | No verified System Dependency Graph exists for the assessed configuration, so the specification's worst-case default applies. It is independently corroborated on its merits: the observed path is ungated end to end and terminates in two irreversible nodes — external disclosure of mail, file, calendar, and conversation content, and a durable memory record that survives password change, session revocation, and device re-registration. The reachable set spans every connector the session holds and every future conversation the memory reloads into.GDCP: corroborated by the observed path elevated |
| RfRemediation Feasibility | 0.50w 0.20 | Scored above the deployment-infrastructure anchor because remediation is split. Microsoft's 2026-08-18 fix closes CVE-2026-24301, but the memory branch requires a different class of work — write-admission quarantine and promotion gates, recall-time rescanning, and a response runbook that deletes the exact poisoned records and verifies no remaining durable state, because the brief documents that password rotation, session revocation, and device re-registration do not satisfy it. No retraining is required, which keeps it below the higher anchors. |
Nelevated = 3 (dimensions strictly above 0.75) → CRM = 1.35.
Compound Risk Alert. Two or more dimensions are simultaneously elevated (spec 3.2.2); architectural decomposition is recommended before deployment.
Layer 3 — Public-evidence confidence diagnostic
| Component | Score | Basis |
|---|---|---|
| Pc — Public provenance evidence | 0.30 | Slightly above the 0.25 anchor. The brief identifies the product surface and its formal name, both parameter mechanisms, the connector set, the memory API, the persistence behaviour across account-recovery actions, the CVE with its CVSS and exploitation status, and the fix date. It identifies no tenant, tool manifest, memory-policy configuration, or evaluation artefact for a specific deployment, and no AIBOM or equivalent record exists. |
| Ec — Public evaluation coverage | 0.29 | coverage 0.31 (8 of 26 applicable sub-metrics) × independence 1.00 × fidelity 0.95. No Full, Standard, or Lite pathway is claimed for a retrospective article. |
| Tf — Public-evidence freshness | 0.24 | Evidence dated 2026-08-18; age 61 days on the workpaper reference date. Components: T_behavior 0.24 · C_event 0.35 · T_containment 0.39 · C_behavior 0.40 · T_calendar 0.63 · C_monitor 0.65 · C_evidence 0.85. Binding term: T_behavior. BAW applies decisively here: long-term memory is mutable behavioural state that persists across sessions, and the second branch writes attacker content directly into it. C_monitor 0.65 — no detection of either branch is evidenced; the brief has to ask defenders to start recording memory writes as security-relevant events with source, caller, content digest, validator result, namespace, and approval. C_event 0.35 — the major row applies: a confirmed critical-invariant violation, namely connected-source exfiltration and a durable poisoned memory record. C_behavior Band 0 (0.40) — no canary set, no registered invariants, and no maintained drift baseline are evidenced, the specification's worst-case default band; the brief's recommendation to rescan memory on every recall and test whether hidden authority survives paraphrasing is exactly the missing battery. C_evidence 0.85 — remediation is partial: the CVE is fixed but the memory-write governance the brief calls for is a separate open item. |
Public-evidence ACI = (Pc × Ec × Tf)1/3 = 0.28 — diagnostic status: Invalid as assessment-of-record evidence. It describes the evidence available to this case study, not the assurance of the underlying system, and is not inserted into the normalized-assurance scenario ERS.
Indicative ERS — normalized-assurance scenario
Published CVSS beside indicative ERS
Each published CVSS record is shown exactly as its scorer published it, one per vulnerability record, with the version, metric group and vector when stated, plus its source and access date. Records are never combined or inferred from a CVE's existence.
INDICATIVE ERS · NORMALIZED-ASSURANCE SCENARIO
8.0 midpoint, interval 3.9–10.0; High scenario band; ACI fixed at 1.00. The published CVSS records do not enter this calculation.
PUBLISHED CVSS · 1 record
CVE-2026-24301 CVSS 3.1 Base 8.8 High
| Published score | 8.8 |
|---|---|
| CVSS version | 3.1 |
| Metric group | Base |
| Severity | High |
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
| Scored by | microsoft |
| Source record | https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/24xxx/CVE-2026-24301.json (accessed 2026-10-18) |
| Affected component | Copilot Web |
| Scope note | CNA affected product and described vulnerability match the scored assessed_system and are not excluded by out_of_scope. |
| Record SHA-256 | c1fe94714685028dd1c8beb40acdd8b8a185e9a4bbbbfdd22af123b1399a67ff |
CVSS describes an individual vulnerability as its scorer published it. Indicative ERS describes the assessed AI deployment under the normalized-assurance scenario, so the two values are not direct equivalents and neither replaces the other.
AIDEFEND defences → AITBM sub-metrics
Identifiers are quoted as they appear on the AIDEFEND in Action brief or in the AIDEFEND SecureFlow defense map (audited AIDEFEND dataVersion 2026.10.15); the sub-metric mapping is AITBM's own, from the specification's AIDEFEND tables reconciled at catalogue data version 2026.10.15. AIDEFEND renumbers identifiers between releases, so the data version travels with every mapping and neither side's IDs should be cited without one. A mapping identifies a possible evidence route; a recommendation does not prove that the control was implemented or effective and receives no scoring credit by itself.
| Technique | Defence | Priority | Evidences |
|---|---|---|---|
| AID-H-018.003 | High-Impact Independent Validation & Approval GateAIDEFEND dataVersion 2026.10.15. A fresh decision bound to the exact prompt, connectors, data classes, destination, and intended action before connected-data access or external fetch is the Cn-6 gate that directly breaks the autorun branch; a link click and an existing login cannot approve an embedded task. | Very High | Cn-1 Cn-6 Cn-7 |
| AID-H-018.005 | Value-Level Capability Metadata & Data Flow Sink EnforcementAIDEFEND dataVersion 2026.10.15. Tagging Gmail, Drive, Calendar, and conversation-history values sensitive and preserving that status through encoding is the Cn-3 control that prevents the exfiltration result even when the prompt and fetch tool both execute. | Very High | Cn-1 Cn-6 Cn-7 |
| AID-I-004.004 | Transactional Promotion Gates (Quarantine -> Trusted)AIDEFEND dataVersion 2026.10.15. Quarantining webpage-derived memory candidates and promoting them only through an atomic, reviewed transition bound to the exact content digest is the Cn-7 state-admission control whose absence lets untrusted text become durable agent state. | Very High | Pr-2 Pr-4 Cn-4 Cn-7 Cn-8 Cn-9 |
| AID-H-002.002 | Inference-Time Prompt & Input ValidationAIDEFEND dataVersion 2026.10.15. Rejecting a parameter combination that both supplies and automatically executes a prompt — or keeping q inert until the user reviews and submits it inside the authenticated session — is the Ro-1 control for the autorun ingress. | High | Ro-1 Ro-5 Fa-1 Fa-3 Cn-8 |
| AID-H-018.004 | Intent-Based Dynamic Capability ScopingAIDEFEND dataVersion 2026.10.15. Generating a short-lived connector and tool scope from a trusted user-visible task is the Pr-3 and Cn-1 control whose absence lets a URL-provided prompt reach unrelated mail, files, calendar entries, and chat history. | High | Cn-1 Cn-6 Cn-7 |
| AID-D-001.005 | Recalled Memory Pre-Rehydration ScanningAIDEFEND dataVersion 2026.10.15. Rescanning each memory record before rehydration, emitting a finding bound to the exact stored version, supplies C_monitor and behavioural-attestation evidence; the brief states it is detection and policy evidence rather than a substitute for write admission. | High | Ro-1 |
| AID-E-005 | Compromised Durable Application Session & Agent State TeardownAIDEFEND dataVersion 2026.10.15. Purging the exact signed conversational-memory records and independently verifying zero remaining state in scope is the Cn-7 teardown operation whose absence the brief demonstrates: password and session changes leave durable memory intact. | High | Pr-3 Cn-9 |
| AID-H-019.002 | Secure HTML Rendering & Content DemotionAIDEFEND dataVersion 2026.10.15. Sanitizing the summarized page into bounded plain text while retaining untrusted provenance is the Cn-8 ingress control for the memory branch; the brief marks it Medium because it constrains ingress without authorizing or blocking the memory write itself. | Medium | Cn-1 Cn-3 Cn-8 |
| AID-M-002.004 | Trust-Tiered Memory/KB Provenance & Write Eligibility ContractAIDEFEND dataVersion 2026.10.15. Recording caller, source, evidence, validator result, namespace, and eligibility decision for every proposed memory write supplies the facts the promotion gate consumes; the brief marks it Medium because the contract does not itself make hidden webpage text trustworthy. | Medium | Ro-4 Ro-5 Fa-3 Tr-3 Tr-4 Pr-3 Cn-9 |
WHAT THIS CASE TEACHES
The memory branch demonstrates persistent-state containment failure, now covered by Cn-9. A webpage-derived record entered durable memory without a promotion gate, and Varonis found that password changes, session revocation, and device re-registration left it in place until explicitly deleted. Recovery therefore requires checking and removing the affected durable state as well as ending sessions.
Sources: AIDEFEND in Action — CoSnitch Combined Copilot Autorun Exfiltration with a Separate Memory-Poisoning Path · Primary source — CoSnitch: One Click to Leak Your Secrets or Poison Copilot's Memory (Varonis Threat Labs, 2026-08-18) · AIDEFEND SecureFlow — CoSnitch: Copilot Web Persistent Memory Poisoning · AIDEFEND SecureFlow — CoSnitch: Copilot Web Autorun Data Exfiltration
AIDEFEND SecureFlow attack-flow cross-reference
The same incident is modelled step by step, with ATLAS technique labels and AIDEFEND defense mappings, in AIDEFEND SecureFlow. The flow is listed for navigation only; this record's evidence and scores come from the sources cited above. Open SecureFlow.
- CoSnitch: Copilot Web Autorun Data Exfiltration (component path · AIDEFEND curated research flow)ATLAS techniques: AML.T0051.000, AML.T0053, AML.T0025
- CoSnitch: Copilot Web Persistent Memory Poisoning (component path · AIDEFEND curated research flow)ATLAS techniques: AML.T0051.001, AML.T0053, AML.T0080.000