This is a research prototype. The data and analyses are preliminary and not yet validated — we'd welcome your .
Security researchers at Lasso Security discovered that Microsoft Copilot could access and expose sensitive data from GitHub repositories that had been briefly public but were subsequently set to private or deleted. This occurred because Microsoft's Bing search engine cached the repository content, and Copilot was able to retrieve this 'zombie data' even after the repositories were no longer accessible to the public. The exposure included internal packages, access keys, and tokens across thousands of organizations. Despite Microsoft disabling the public-facing Bing cache link, researchers found that Copilot retained access to the underlying cached data.
Lasso Security reported that Microsoft Copilot could return content from GitHub repositories that had been public briefly but later set to private or deleted. Lasso attributed this to Bing's caching system, which stored "zombie data" from over 20,000 repositories. The cached content allegedly included sensitive information such as access keys, tokens, and internal packages. Microsoft reportedly classified the issue as low severity and applied only partial mitigations.
Domain classification, causal taxonomy, severity scores, and national security assessments were LLM-classified and may contain errors.
AI systems that memorize and leak sensitive personal data or infer private information about individuals without their consent. Unexpected or unauthorized sharing of data and information can compromise user expectation of privacy, assist identity theft, or cause loss of confidential intellectual property.
Also classified as
The incident highlights a security vulnerability in Copilot's data retrieval boundaries, where it bypassed standard web access controls to retrieve cached private data.
The AI system Copilot retrieved and leaked highly sensitive, non-public corporate data, including private keys, tokens, and internal packages, from cached repositories that had been made private.
AI system
Due to a decision or action made by an AI system
Unintentional
Due to an unexpected outcome from pursuing a goal
Post-deployment
Occurring after the AI model has been trained and deployed
The incident was caused by Microsoft Copilot retrieving and exposing cached data that was supposed to be private, which was an unexpected outcome of its search and retrieval capabilities.
Microsoft Copilot was found to retrieve and expose sensitive 'zombie data' (cached private keys, secrets, and internal packages) from over 16,000 organizations, including major technology firms. This systemic data leakage highlights a critical vulnerability in AI-enabled search retrieval systems, posing substantial risks to international information security and technological competitiveness.
The report describes Microsoft Copilot as a generative AI chatbot that users query to retrieve information, acting as an assistant to help users find data, but in this case, overly eagerly retrieving cached private data.
Risk Level 3. Limited Risk: Microsoft Copilot is a chatbot, which falls under the category of AI systems that pose a moderate risk and require specific transparency obligations to ensure users are informed and aware of the AI's nature.
Microsoft Copilot is primarily designed as a conversational assistant for question answering and content search, retrieving information from the web to answer user queries.
The reports from Lasso Security and TechCrunch provide clear, detailed, and consistent technical explanations of how the caching mechanism and Copilot retrieval worked. The scale of the exposure (20,580 repositories, 16,290 organizations) is explicitly quantified, and Microsoft's response and partial mitigation are documented.
The incident could be viewed purely as a search engine caching issue (Bing) rather than an AI safety issue, though Copilot's ability to bypass the disabled public cache links to retrieve the data makes it an AI-specific risk.
Technology
Copilot Backend Cache Access
Copilot accessed cached data even after public cache links were disabled.
Persistent Search Engine Caching
Bing cached and stored data from repositories during their brief public phase.
RAG Permission Integration Gap
Retrieval system failed to sync real-time permission states of source repos.
Data Inputs
Accidental Public Code Exposure
Organizations temporarily published private repositories containing secrets.
Unsanitized Historical Data
Cached zombie data remained in indexing databases after source deletion.
Hardcoded Secrets in Code
Private tokens and API keys were committed directly to GitHub repositories.
Human Factors
Developer Configuration Errors
Developers accidentally set private repositories to public temporarily.
Delayed Secret Rotation
Users failed to rotate compromised keys immediately after exposure.
Process and Methods
Incomplete Vulnerability Patching
Microsoft blocked human UI cache access but left Copilot backend open.
Lack of Real-Time Auth Checks
RAG pipelines did not verify live GitHub permissions before outputting data.
Management
Underestimating Security Severity
Microsoft classified the zombie data exposure risk as low severity.
Risk Assessment Failures
Management failed to assess risks of integrating search caches with LLMs.
AI system involved
Identified by automated extraction; can differ from the alleged developers above.
