Microsoft Copilot vulnerability exposes Fortune 500 data (Lasso Security)
Date: 2024-12
Affected: Microsoft Copilot / Fortune 500
Attack vector: data-exfiltration
Category: real-world
Severity: High

Lasso Security identified a major Microsoft Copilot vulnerability that exposed indexed enterprise data from Fortune 500 companies through Bing/Copilot's caching of formerly public-then-private GitHub repository content.


Mitigations:

Architectural layers (MAESTRO):