Microsoft has shipped a fix for a vulnerability nicknamed CoSnitch in the personal version of Copilot, roughly eight months after security researchers at Varonis Threat Labs first reported it in December 2025. The flaw let an attacker get a victim to click a single malicious link and, from there, silently pull sensitive data out of whatever third-party accounts and services the victim had connected to Copilot, without triggering any obvious alert to the user. Varonis says it found the bug by getting Copilot to essentially describe its own internal architecture and data-access patterns during testing, which is what gives the flaw its name: the assistant ended up "snitching" on the very connections an attacker needed to abuse. This is the third distinct Copilot vulnerability Varonis has reported to Microsoft this year, following an earlier issue called Reprompt that bypassed guardrails through repeated queries, and another dubbed SearchLeak. For teams building or operating on top of AI assistants that get wired into email, calendars, file storage, CRMs, and other connected apps, the practical lesson is that the attack surface isn't just the model's outputs, it's the entire permission graph the assistant has been granted, and that graph is often invisible to the end user. A one-click exfiltration bug in a widely deployed assistant is a strong argument for treating AI-assistant integrations with the same rigor as OAuth scopes and API keys: least-privilege connections, regular audits of what an assistant can actually reach, and monitoring for unusual data-access patterns coming from assistant sessions rather than just human logins. It's also notable that Microsoft's disclosure-to-patch window was close to eight months for a critical-rated vulnerability, slow compared to typical enterprise SLAs, and likely to fuel further scrutiny of how AI vendors prioritize security fixes for assistant features versus traditional software components. Varonis said it saw no evidence of in-the-wild exploitation before the patch shipped, but the technique is now public, so any organization still running an unpatched version should treat this as urgent.