Published 3 days ago • loading... • Updated 1 day ago

Copilot exposes private GitHub pages, some removed by Microsoft

Security researchers warn that data exposed to the internet can remain accessible in Microsoft Copilot, even if it has been made private.
Lasso, an Israeli cybersecurity firm, found more than 20,000 private GitHub repositories from over 16,000 organizations, including Microsoft, exposed through Copilot.
Lasso co-founder Ophir Dror stated that their own repository was indexed and cached by Bing before being set to private.
Microsoft classified the caching issue as low severity, stating the behavior is acceptable, but updated changes were made after the report.

Insights by Ground AI

Does this summary seem wrong?

9 Articles

All

Left

Center

Right

Tech Spot

Chatbots are surfacing data from GitHub repositories that are set to private

Popular chatbot services like Copilot and ChatGPT could theoretically be exploited to access GitHub repositories that their owners have set to private. According to Israeli security firm Lasso, this vulnerability is very real and affects tens of thousands of organizations, developers, and major technology companies.Read Entire Article

1 day ago

Read Full Article

Ars Technica

Copilot exposes private GitHub pages, some removed by Microsoft

Repositories once set to public and later to private, still accessible through Copilot.

2 days ago·United States

Read Full Article

BoredPanda

Disney Worker Downloads Free AI Tool—Loses Job And $200,000 Bonuses

The life of a Disney worker took a dramatic turn when he was hacked after downloading a free AI tool to use with his children. Matthew Van Andel, a former engineer at the renowned company, downloaded the software from the code-sharing site GitHub in February 2024. The tool, supposedly designed to create images from text prompts, ended up being malware that gave hackers access to his personal information through a password manager. In July, five …

3 days ago·Boston, United States

Read Full Article

TechCrunch

Thousands of exposed GitHub repos, now private, can still be accessed through Copilot

Data exposed even briefly can live on in generative AI chatbots long after the data is made private.

3 days ago·United States

Read Full Article

dailyguardian.ca

Zapier says someone broke into its code repositories and may have accessed customer data

Hello, We are writing to inform you of a security incident. Due to a two-factor authentication (2FA) misconfiguration on an employee’s account, an unauthorized user gained access to certain Zapier code repositories. Normally, this would not impact our customers. Out of an abundance of caution, we audited the contents of the repositories, and we found that in isolated instances, certain customer information had been inadvertently copied to the re…

1 day ago

Read Full Article