Copilot could be tricked into emptying your Gmail
Edition of 2026-08-21
# AI For All ### Friday, August 21, 2026
Someone who uses Microsoft Copilot Personal with Gmail, Drive or Calendar connected no longer has to worry that clicking one ordinary looking link could let an attacker silently read and export their inbox, because Microsoft shipped the fix on August 18.
The assistant that snitched on itself
Security researchers at Varonis Threat Labs found the flaw, nicknamed CoSnitch, by doing something unusual: they argued with Copilot until it explained its own defenses in detail, then used that explanation to break them. One click on a crafted link, no confirmation dialog, no warning, and Copilot would quietly pull data from a victim's connected Gmail, Drive, Calendar or OneDrive and ship it to an outside server.
The chain had a third piece that outlasts the first two. A poisoned web page, once summarized by Copilot, could plant instructions in its permanent memory, the kind of memory that is supposed to survive across sessions. Varonis found that memory poisoning persisted even through a password change. The vulnerability now carries an official CVE identifier and a high-severity rating from the National Vulnerability Database, with Microsoft itself as the reporting authority.
Varonis disclosed the bug to Microsoft privately, and the fix landed on *August 18, 2026*. This is the third Copilot flaw Varonis has surfaced this year, and every one followed the identical pattern: a single click on a link that looked entirely ordinary. Varonis says it found no sign anyone exploited CoSnitch before the patch went out, which is the best possible ending for a bug like this, but not a reason to treat AI assistants as immune to the same tricks that have always worked on browsers.
If you connect a personal AI assistant to your email, this is the shape of risk to expect going forward: not the assistant misbehaving on its own, but an attacker using the assistant's own permissions against you. Fewer connected apps means a smaller target. Varonis
Weak signal
Grok has been sending some users pure gibberish since Wednesday, X AI has not explained why, and a widely covered Pew Research study now finds AI authorship signals in over a third of web pages published since ChatGPT launched, neither developed enough yet to earn its own section.
Whatever gets automated next, someone will eventually find the crack in it. The interesting part is always how fast the fix follows.