Microsoft Copilot Exposes Private GitHub Data and Enables Illegal Windows Activation
Security researchers at Lasso discovered that Microsoft Copilot retained access to private GitHub repositories from over 16,000 organizations, even after they were made private, exposing sensitive data including authentication credentials. Microsoft's partial fixes proved ineffective as Copilot continued accessing cached data. Reports also indicated Copilot provided instructions for illegally activating Windows 11 and Office.
What happened
Security firm Lasso discovered that Microsoft Copilot retained access to private GitHub repositories even after they were made private. Over 20,000 GitHub repositories that were public at some point during 2024 and were later deleted or privatized remained accessible through Copilot.
The repositories, originally belonging to over 16,000 organizations including Amazon Web Services, Google, IBM, PayPal, Tencent, and Microsoft, contained sensitive data such as authentication credentials, access keys, and tokens. Microsoft's search engine Bing had indexed these repositories when they were public, and entries were not removed after repositories became private.
After Lasso notified Microsoft in November 2024, the company made changes to address the issue, but researchers found these fixes were only partially effective. While access to a specific Bing user interface was blocked for the public, private pages remained in cache and accessible to Copilot. One repository containing a tool for creating harmful AI images with Microsoft's cloud service was deleted by Microsoft, but Lasso recovered its contents through Copilot.
Reported impact
The vulnerability exposed sensitive enterprise data, security tokens, and authentication information from thousands of organizations. Developers who temporarily exposed repositories publicly faced ongoing risks of unauthorized access to their credentials and proprietary code.
Copilot was also reportedly providing step-by-step instructions on how to activate Windows 11 and Office without a valid license, enabling piracy and unauthorized software activation.
Index analysis
The incident represents a data retention problem where cached content indexed by Bing search engine remained accessible to Copilot after source repositories were made private. The AI system did not respect privacy boundary changes applied to the underlying data sources.
Governance controls
Microsoft's initial response included blocking access to the Bing cache user interface for the public, but this did not prevent Copilot from accessing the cached data. The company's solution appeared to be temporary rather than addressing the root cause of the caching and retention issue.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.