A researcher tricked Copilot into exposing its own hidden bug. Construction's new AI agents run on the same architecture
Microsoft patched three chained flaws in its consumer Copilot app that let one click silently pull data from a user's connected accounts. The product isn't used on job sites, but the architecture it exposed — an AI agent with autonomous tool use and connected data access — is what Procore's and Trimble's new construction AI agents run on.
Microsoft just patched three chained flaws in Copilot Personal, its consumer AI assistant, that let a single click silently pull data out of a user's connected accounts. The product itself has nothing to do with construction. The architecture it exposed does: an AI agent with standing access to your accounts, its own tools to fetch and act on data, and memory that persists across sessions — which is exactly what Procore's and Trimble's newest construction AI agents are built on.
What actually happened to Copilot?
Varonis Threat Labs found three vulnerabilities it grouped under the name CoSnitch. First, an undocumented URL parameter caused any attacker-supplied prompt to execute the instant a crafted link loaded — no click past the initial one, no confirmation dialog. Second, that injected prompt could query the victim's connected apps (Gmail, Drive, Calendar, OneDrive) and exfiltrate the results through Copilot's own built-in web-fetch capability to an attacker's server. Third, a separate flaw let a malicious webpage inject instructions into Copilot's permanent memory store just by having Copilot summarize it — a persistence path independent of the one-click chain.
Varonis found the bug through what it called "meta-hacking": researchers kept asking Copilot to explain why automatic prompt execution was supposedly impossible, and its answers eventually described the undocumented parameter that made it possible. Varonis reported the issue to Microsoft in December 2025. Microsoft shipped a server-side fix on August 18, 2026 — about eight months later — and says it found no evidence CoSnitch was exploited before the patch.
Does this touch the tools a GC actually runs?
Not directly. CoSnitch lives in Copilot Personal, the free consumer app tied to a personal Microsoft account and personal Gmail, Drive, and Calendar — not Microsoft 365 Copilot, the version businesses license to connect to work email, SharePoint files, and Teams. No construction platform was named in any disclosure, and there's no reported version of this bug in Procore, Trimble, Autodesk, or any AEC tool. So don't read this as "your project software has this hole." It doesn't, as far as anyone has shown.
Then why does it matter to construction?
Because the same three-part shape — an agent that acts on your behalf, tools it can invoke on its own, and memory that carries forward — is precisely what construction software vendors are racing to ship as their next AI feature, not some future one.
| System | Standing data access | Autonomous tool use | Persistent memory |
|---|---|---|---|
| Copilot Personal (where CoSnitch lived) | Gmail, Drive, Calendar, OneDrive | Built-in web fetch | Yes — the flaw that got poisoned |
| Procore Digital Coworker (GA since July 23, 2026) | RFIs, submittals, contracts, daily logs across a project | 20 prebuilt agents acting on that data | Vendor-managed, not public |
| Trimble + Document Crunch (acquisition agreed April 2026) | Contracts across 10,000+ deployed projects | AI reads for risk provisions, payment disputes, spec gaps | Vendor-managed, not public |
Procore's Digital Coworker packages went generally available on July 23, 2026, with a 20-agent library that includes RFI, Submittal Review, Contract Review, and Daily Log agents reading and acting on live project data. Trimble's Document Crunch, which it agreed to acquire in April 2026 and is folding into Trimble Construction One, already reads contracts on more than 10,000 projects for exactly the kind of risk language CoSnitch's researchers were probing Copilot to expose about itself. Neither vendor has disclosed a CoSnitch-class flaw. That's not the point — the point is that CoSnitch is the first well-documented, technically detailed public case of this exact system shape failing, and it's a useful checklist for anyone evaluating or already running the construction version of it.
What should you actually ask your vendor?
Three questions, none of which require waiting for an incident:
- Can the agent execute instructions embedded in a document it reads? A submittal PDF, an RFI attachment, or a spec section is exactly the kind of file an AI agent is now asked to open and act on — the same shape Copilot's webpage-summarization flaw exploited.
- Does it keep memory across sessions, and can one bad document corrupt it? If yes, ask how that memory is scoped — to one project, one company, or shared infrastructure.
- What does a single compromised file or link actually reach? One RFI thread, or the platform's full contract library?
None of this means pull back from AI agents in construction software — Procore and Trimble both have real reasons customers are adopting these tools. It means treating agent architecture as a vendor-vetting question with the same seriousness as insurance certificates or bonding capacity, because CoSnitch just showed, in detail, how this exact category of system breaks.
The same connected-agent pattern keeps showing up as a security question — an AI notetaker bug let strangers into 181,000 live meetings back in August.
Friday one chart. Every week, one piece of data that should change a decision on your project. Subscribe at constructionaibrief.com.
- What is CoSnitch (CVE-2026-24301)?
- CoSnitch is a set of three chained vulnerabilities in Microsoft's consumer Copilot Personal app. An undocumented URL parameter let an attacker-crafted link auto-execute a hidden prompt with no click or confirmation needed, that prompt could query the victim's connected accounts (Gmail, Drive, Calendar, OneDrive) and exfiltrate the results through Copilot's own web-fetch tool, and a separate flaw let a malicious webpage poison Copilot's persistent memory when summarized. Varonis Threat Labs reported it to Microsoft in December 2025; Microsoft shipped a server-side fix on August 18, 2026, and found no evidence it was exploited in the wild.
- Does CoSnitch affect the Microsoft 365 Copilot construction firms use in Teams and SharePoint?
- No. CoSnitch was found in Copilot Personal, the free consumer app tied to a personal Microsoft account, not Microsoft 365 Copilot, which businesses license separately to connect to work data in Outlook, SharePoint, and Teams. The vulnerable component is different, but it runs on the same underlying pattern — an AI agent with autonomous tool use and connected data access — that enterprise and construction-specific AI agents also use.
- What construction software uses a similar AI agent architecture?
- Procore's Digital Coworker packages, generally available since July 23, 2026, give AI agents standing access to project data across a library of 20 prebuilt agents, including RFI, Submittal Review, Contract Review, and Daily Log. Trimble agreed in April 2026 to acquire Document Crunch, an AI tool that reads contracts for risk provisions and has been deployed on more than 10,000 projects, and is folding it into Trimble Construction One.
- Was any construction AI tool actually breached like Copilot was?
- No. There's no reported CoSnitch-style incident in any construction software. This is a pattern warning, not an active exploit — CoSnitch is a concrete, documented case of how the exact category of system now shipping into RFI, submittal, and contract-review tools can fail.
- What should a GC or sub ask an AI vendor after a bug like this?
- Ask whether the agent can execute instructions embedded inside documents it reads, such as a poisoned RFI attachment or spec PDF, whether it keeps memory that a single bad document could corrupt across future sessions, and what a compromised file or link actually reaches — one project, or the vendor's entire platform.