Archive — US — techcrunch
Thousands of exposed GitHub repos, now private, can still be accessed throughCopilot
Security researchers warn that thousands of once-public GitHub repositories, now private, can still be accessed through Microsoft Copilot due to caching by Bing. Over 20,000 repositories, including sensitive data from major companies like AWS, Google, and Microsoft, have been exposed. Lasso advised affected firms to secure their data, highlighting risks from generative AI tools even after repos become private.
Key points
- Thousands of once-public GitHub repositories are now private but accessible via Microsoft Copilot.
- Lasso found their own GitHub data appearing in Copilot because it was indexed by Bing's search engine.
- Lasso identified 20,000 repositories exposed through Copilot, affecting over 16,000 organizations.
- Critical data includes intellectual property, access keys, and corporate secrets.
- Microsoft classified the issue as low severity but acknowledged it in November 2024.
Why it matters
- The incident reflects broader IT trends of data security risks associated with generative AI tools.
- Similar vulnerabilities have been noted as generative AI integration increases in corporate environments.
- Caching mechanisms in search engines and AI tools can unintentionally retain sensitive data, echoing past data leakage events.
This incident underscores the need for heightened data security measures as generative AI tools evolve, indicating that even private data can be compromised, necessitating proactive management in tech environments.