How we rooted Copilot(research.eye.security)

341 points by uponasmile 1 year ago | 136 comments

Eye Security research blog post describing how the team gained root access inside Microsoft Copilot's code execution sandbox.

Microsoft Copilot Cowork Exfiltrates Files(promptarmor.com)

217 points by Kneenex 5 months ago | 46 comments

GitHub Copilot CLI downloads and executes malware(promptarmor.com)

43 points by sarelta 8 months ago | 12 comments

Retina – eBPF distributed networking observability tool for Kubernetes(github.com)

147 points by boratanrikulu 2 years ago | 23 comments

CVE-2023-40547 – avoid incorrectly trusting HTTP headers(github.com)

239 points by DyslexicAtheist 2 years ago | 103 comments

Passkeys are generally available(github.blog)

82 points by yarapavan 3 years ago | 52 comments

Stealing OAuth tokens of Microsoft accounts via open redirect in Harvest App(eval.blog)

349 points by skilled 3 years ago | 102 comments

A security researcher's write-up on leaking Microsoft account OAuth tokens through an open redirect vulnerability in the Harvest time-tracking app.

I could've accessed 17T Microsoft records(blog.faav.net)

287 points by luispa 27 days ago | 120 comments

A security researcher's blog post describing a Microsoft internal analytics service flaw where unchecked token signatures allowed admin access to query 17.3 trillion records.

Microsoft breached antitrust rules by bundling Teams and Office, EU says(apnews.com)

669 points by cbg0 2 years ago | 734 comments

AP News article reporting that the European Union found Microsoft breached antitrust rules by bundling Teams with its Office software.

Flaw has Microsoft Authenticator overwriting MFA accounts, locking users out(csoonline.com)

412 points by miles 2 years ago | 271 comments

CSO Online news article on a Microsoft Authenticator design flaw that overwrites existing MFA accounts when new ones are added, locking users out.

Microsoft will switch off Recall by default after security backlash(wired.com)

444 points by georgehill 2 years ago | 397 comments

Wired article reporting that Microsoft will make its AI Recall screen-recording feature opt-in and add privacy protections after security criticism.

Everything authenticated by Microsoft is tainted(graz.social)

653 points by ColinWright 3 years ago | 277 comments

A Mastodon post by Karl Voit arguing that the Microsoft Azure cloud hack, including 60,000 stolen US State Department emails, means everything Microsoft authenticates is tainted.