Microsoft Copilot accessing cached GitHub repository data after privatization
Researchers found that Microsoft Copilot can access cached content from GitHub repositories that were once public but have since been made private. The vulnerability affects thousands of repositories from major organizations including Microsoft, Google, IBM, PayPal, and Tencent, with data potentially accessible through Bing's search cache.
What happened
Researchers from Lasso discovered that Microsoft Copilot could access cached content from GitHub repositories that had been made private after being public. The repositories had been indexed by Microsoft's Bing search engine while public, and their cached content remained accessible through Copilot even after the repositories were set to private.
Lasso investigated by extracting a list of repositories that were public at any point in 2024 and identified those that had since been deleted or made private. Using Bing's caching mechanism, the company found more than 20,000 since-private GitHub repositories with data still accessible through Copilot, affecting more than 16,000 organizations.
Reported impact
Affected organizations include Amazon Web Services, Google, IBM, PayPal, Tencent, and Microsoft. For some affected companies, Copilot could be prompted to return confidential GitHub archives containing intellectual property, sensitive corporate data, access keys, and tokens.
Lasso identified a GitHub repository previously hosted by Microsoft that contained a tool for creating offensive and harmful AI images using Microsoft's cloud AI service, which had been deleted but was retrievable through Copilot.
Index analysis
The vulnerability stems from the interaction between Copilot and Bing's caching mechanism. When repositories are indexed by Bing while public, the cached pages persist in Bing's search index even after the repository is made private, allowing Copilot to access and return information from these cached pages.
Governance controls
Lasso advised affected companies that were severely affected by the exposure to rotate or revoke any compromised keys. The company removed references to Amazon Web Services following legal advice.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.