30
45
Microsoft Copilot reveals secret input that allowed it to be hacked
Microsoft disclosed a hidden input in Copilot that let attackers steal passwords from users who clicked a crafted link.
Microsoft revealed that Copilot contained a secret, undocumented input parameter that allowed the assistant to be compromised. Attackers could abuse the hidden input to steal passwords when a target clicked a malicious link. The disclosure highlights hidden-parameter risks in widely deployed AI assistants.
58
30
30
50
30
30
30
30
30
30
30
30
30
30
30
30
30
30
30
30
30
30
30
30
35
Confusedpilot Attack Targets Ai
ConfusedPilot attack exploits Microsoft 365 Copilot's retrieval pipeline to expose confidential enterprise data in AI responses.
ConfusedPilot targets Microsoft 365 Copilot's retrieval-augmented generation pipeline, potentially causing the assistant to surface confidential enterprise content in generated responses. Researchers disclosed the technique as a Copilot data confidentiality flaw affecting search and caching behavior. It highlights the emerging attack surface in enterprise AI assistants that access corporate data stores.
50
30
30
30
30
30
35
30
30
30
30
30
30