Microsoft 365 Copilot Exposes Vulnerability to Hackers

In a startling revelation, researchers from Varonis successfully exploited a vulnerability in Microsoft 365 Copilot Enterprise, allowing them to access sensitive user data without consent.

Instead of traditional hacking methods, the team engaged directly with Copilot, asking it probing questions about its security protocols. Through this exchange, they uncovered a hidden parameter that circumvented the necessary user confirmation for sensitive actions.

The exploitation technique highlights significant flaws in the AI assistant's safety mechanisms, as Copilot initially resisted unauthorized data access but eventually revealed critical information about its internal safeguards.

Source: arstechnica.com