Copilot memory poisoning is a real, now-patched vulnerability, and the detail that matters most is this: a password reset did not clean it. In August 2026, the security firm Varonis disclosed a chain of flaws in Microsoft Copilot Personal, nicknamed CoSnitch and tracked as CVE-2026-24301, that let a single booby-trapped web page write hidden instructions into what Copilot remembers about you. Microsoft shipped the full fix on August 18, 2026. So is Copilot safe to use now? The specific bug is closed, but the lesson underneath it is bigger than one product. An AI memory you cannot inspect, and that untrusted content can write to on its own, is the actual risk, and CoSnitch is the clearest real-world proof of it so far.
What the CoSnitch bug actually did
CoSnitch turned a single click, and in the worst case a page load with no click at all, into a way to steal data and quietly rewrite Copilot's memory. Varonis chained three weaknesses in the consumer product at copilot.microsoft.com. First, an undocumented URL parameter, reported as autorun=1, made Copilot run an embedded prompt automatically. A normal link using only the ?q= parameter just pre-fills the box and waits for you to press Enter. Adding autorun=1 removed that step, so the attacker's instruction fired on page load.
The second weakness let those instructions reach across your connected accounts. Because Copilot Personal can link to services through OAuth, a running prompt could read from Gmail or Outlook, Google Calendar, Google Drive, your Copilot chat history, and your Copilot memory, then smuggle what it found out to an attacker's server by packing the data into a web address. The third weakness is the one this article is about: when Copilot summarized a web page the attacker controlled, it could not tell the difference between text to summarize and instructions to obey, so the page could tell Copilot to save an instruction into your long-term memory. Varonis said it found no evidence that CoSnitch was exploited in the wild.
The frightening part is not that Copilot could be tricked once. It is that the trick could be written into memory and then apply to every future conversation until someone noticed and deleted it.
Why a password reset does not remove poisoned memory
A password reset does nothing because the injected instruction does not live in your password or your session. It lives in Copilot's persistent memory, a separate long-term store. Varonis reported that the poisoned entry survives password changes, session revocation, and even device re-enrollment, and stays active in later chats until you manually delete it from Copilot's memory settings. Rotating credentials is the standard advice after almost any account scare, and here it accomplishes nothing.
It is also close to invisible. According to Varonis, the poisoned entry is recorded only in Copilot's memory settings, a screen most people have never opened, and every standard incident response step leaves it in place. Put those two facts together and you get the uncomfortable shape of the problem: a silent write, into a store nobody checks, that ordinary account recovery cannot undo.
Memory poisoning and prompt injection, in plain language
Prompt injection is when an AI reads text that contains hidden orders and follows them as if they came from you. The model has one channel for everything it reads, so a web page, an email, or a document can slip in commands next to the content it was supposed to just summarize. Memory poisoning is prompt injection that sticks. Instead of only affecting the current answer, the injected command tells the assistant to remember something, and that false memory shapes its behavior from then on.
A simple way to picture it: imagine a personal assistant who writes notes about you on sticky pads. Prompt injection is a stranger walking up and whispering a fake instruction. Memory poisoning is that stranger writing the instruction on a sticky note and pressing it inside your assistant's notebook, where it keeps getting read aloud long after the stranger is gone. You would only catch it by reading the notebook. That is exactly why an AI memory is only as safe as your ability to see and edit what is in it.
If you use any AI assistant with a memory feature, open its memory or personalization settings today and read the saved entries. Delete anything you do not recognize. It is the one check that a password change cannot do for you.
Was enterprise Copilot really unaffected?
Microsoft's line was that this was a consumer problem. The company stated that enterprise customers using Microsoft 365 Copilot are not affected. The disclosure itself centers on Copilot Personal at copilot.microsoft.com, so that framing is not baseless.
Analysts pushed back on how clean that sounds. Enterprise environments routinely contain consumer-grade Copilot instances signed in with employees' personal accounts, so a company can carry the consumer risk without ever deploying the consumer product on purpose. The timeline did not help Microsoft's case either. Varonis reported the chain on December 31, 2025, Microsoft partially patched the auto-execution piece on February 1, 2026, and the complete fix did not arrive until August 18, 2026, roughly eight months after the first report. A patched bug and a downplayed blast radius are two different things, and the second is worth watching more than the first.
What CoSnitch proves about AI long-term memory
The bug is not really the story. Bugs get patched, and this one was. The story is that persistent AI memory carries a new kind of risk that a fix for one URL parameter does not remove. Once an assistant can store facts about you and act on them later, three questions decide whether that memory is safe to trust: Can you see everything in it? Can you correct or delete any entry yourself? And can anything other than you write to it without your say-so? CoSnitch failed the third question badly, because a random web page could write, and it failed the first in practice, because almost nobody inspects the memory screen.
The honest conclusion is not that AI memory is doomed. It is that memory should be treated like any other account you own. You get to audit it, you get to reset it, and untrusted content does not get to edit it while you are not looking. A memory feature that quietly absorbs whatever it reads is convenient right up until the moment it absorbs something it should not. The safer design puts you, not a summarized page, in charge of what gets remembered.
Poisonable memory versus memory you can audit
The difference between the CoSnitch pattern and a safer approach comes down to who can write, whether you can see what is stored, and whether you can undo it. The table below lines up the behavior Varonis documented against the properties a personal memory should have. No product can promise it is immune to prompt injection, so the honest safeguard is not a magic shield. It is being able to inspect and reset your own memory, and keeping unattended writes out of it.
| What you are comparing | Copilot Personal memory (as exploited) | An auditable memory like MemX |
|---|---|---|
| Who can write to it | A web page Copilot summarized could inject an instruction with no click and store it | Only you, through scoped writes you initiate, not a random page you happened to view |
| Can you see what is stored | Only inside a memory settings screen most people never open | Every saved item is visible and searchable, shown with the source it came from |
| Does a password reset clear a bad entry | No. Reporting says it survives password changes, session revocation, and device re-enrollment | You delete or edit any entry yourself, so a bad one does not linger unseen |
| Does it claim injection immunity | Patched after disclosure, but the model still could not tell content from instructions | No app can claim immunity. The safeguard is inspect-and-edit plus no unattended writes |
| Where your data lives | One assistant wired into Gmail, Drive, and Calendar through OAuth | Private by architecture: per-user isolation, encryption at rest, on-device where possible, no training on your data |
What a safer personal memory looks like
MemX is a consumer memory app built on the opposite assumption from a silently writable store. It holds your documents, photos, voice notes, and messages so you can ask a question and get an instant answer with the source, and it is private by architecture: per-user isolation, encryption at rest, on-device processing where possible, and no training on your data. To be clear, MemX does not claim it is immune to prompt injection, and no honest product should. That is not the point being made here.
The point CoSnitch drives home is narrower and more useful. A personal memory should be auditable, and writes to it should be scoped to things you actually add, not to whatever a page you glanced at decided to save. When you can see every item, trace it to where it came from, and delete it in one step, a poisoned entry cannot hide, and a fix does not depend on a vendor noticing a URL parameter eight months later. Convenience that you can inspect beats convenience you have to trust blindly.
The takeaway from August 2026 is not to abandon AI memory. It is to prefer memory you can read, correct, and reset over memory that reads and remembers on your behalf without asking.
Frequently asked questions
01Is Microsoft Copilot safe to use now?
The specific CoSnitch flaws are patched. Microsoft shipped the full fix on August 18, 2026, and Varonis found no evidence of exploitation in the wild. If you used Copilot Personal earlier, open its memory settings and delete any saved entry you do not recognize, since a poisoned one would not be removed by a password change.
02What is the CoSnitch bug?
CoSnitch is a chain of vulnerabilities in Microsoft Copilot Personal disclosed by Varonis in August 2026 and tracked as CVE-2026-24301. It let a crafted link or web page run instructions, pull data from connected apps like Gmail and Drive, and write hidden commands into Copilot's long-term memory.
03What is AI memory poisoning?
Memory poisoning is prompt injection that persists. An attacker hides instructions in content the AI reads, the AI mistakes them for orders, and it saves them into its memory. The false memory then shapes future answers until someone finds and deletes it, which is why inspectable memory matters.
04Why does the poisoned memory survive a password reset?
Because the injected instruction sits in Copilot's persistent memory, not in your session or password. Varonis reported that it survives password changes, session revocation, and device re-enrollment. The only way to clear it is to delete the entry manually from the memory settings screen.
05Was Microsoft 365 Copilot for business affected?
Microsoft said enterprise customers using Microsoft 365 Copilot are not affected. Some analysts questioned that framing, noting that consumer Copilot instances signed in with employees' personal accounts often live inside enterprise environments, carrying the same consumer risk.
