Microsoft Copilot Reportedly Able to Access Cached Data from Since-Private GitHub Repositories

Lasso Security reported that Microsoft Copilot could return content from GitHub repositories that had been public briefly but later set to private or deleted. Lasso attributed this to Bing's caching system, which stored "zombie data" from over 20,000 repositories. The cached content allegedly included sensitive information such as access keys, tokens, and internal packages. Microsoft reportedly classified the issue as low severity and applied only partial mitigations.

Risk classification

• Primary risk domain: 2 Privacy & Security
• Primary risk subdomain: 2.1 Compromise of privacy by obtaining, leaking or correctly inferring sensitive information

The AI system Copilot retrieved and leaked highly sensitive, non-public corporate data, including private keys, tokens, and internal packages, from cached repositories that had been made private.

Additional risk subdomains

• 2.2 AI system security vulnerabilities and attacks: The incident highlights a security vulnerability in Copilot's data retrieval boundaries, where it bypassed standard web access controls to retrieve cached private data.

Causal factors

• Entity: AI
• Intent: Unintentional
• Timing: Post-deployment

The incident was caused by Microsoft Copilot retrieving and exposing cached data that was supposed to be private, which was an unexpected outcome of its search and retrieval capabilities.

EU AI Act risk tier

• Risk tier: 3 Limited Risk

Risk Level 3. Limited Risk: Microsoft Copilot is a chatbot, which falls under the category of AI systems that pose a moderate risk and require specific transparency obligations to ensure users are informed and aware of the AI's nature.

AI system and alleged parties

• AI system: Microsoft Copilot (Microsoft)
• AI purpose: Question Answering; Content Search
• Behaviour type: Assistant
• Alleged developer: Microsoft
• Alleged deployer: Microsoft
• Alleged harmed parties: GitHub users, GitHub repositories, GitHub

Harm severity

Severity ratings are based on this scale.

Highest direct severity in any category: Substantial. Severity is scored from Negligible to Catastrophic in each harm category, for harm the reports describe as caused directly or indirectly by the AI system.

• Physical: direct Negligible, indirect Negligible
• Infrastructure: direct Negligible, indirect Negligible
• Property: direct Negligible, indirect Negligible
• Financial: direct Negligible, indirect Negligible
• Environmental: direct Negligible, indirect Negligible
• Malicious content: direct Negligible, indirect Negligible
• Differential treatment: direct Negligible, indirect Negligible
• Civil rights: direct Negligible, indirect Negligible
• Democracy: direct Negligible, indirect Negligible
• Privacy: direct Substantial, indirect Negligible
• Psychological: direct Negligible, indirect Negligible
• Epistemic: direct Negligible, indirect Negligible
• Child sexual exploitation and abuse: direct Negligible, indirect Negligible

Privacy

Reported: The report explicitly describes privacy and confidentiality violations where sensitive corporate data and secrets were exposed.

Directly caused: Copilot directly retrieved and exposed cached private data, including 300+ private tokens, keys, and secrets, and 100+ internal packages across 16,290 organizations.

Inferred additional harm: It is highly likely that additional unquantified sensitive personal data or proprietary code was exposed to users who queried Copilot during the period the vulnerability was active.

People affected

• Occurrences reported: 1
• People reportedly exposed: 16290

Potential causes

Management

• Underestimating Security Severity: Microsoft classified the zombie data exposure risk as low severity.
• Risk Assessment Failures: Management failed to assess risks of integrating search caches with LLMs.

Technology

• Copilot Backend Cache Access: Copilot accessed cached data even after public cache links were disabled.
• Persistent Search Engine Caching: Bing cached and stored data from repositories during their brief public phase.
• RAG Permission Integration Gap: Retrieval system failed to sync real-time permission states of source repos.

Data Inputs

• Accidental Public Code Exposure: Organizations temporarily published private repositories containing secrets.
• Unsanitized Historical Data: Cached zombie data remained in indexing databases after source deletion.
• Hardcoded Secrets in Code: Private tokens and API keys were committed directly to GitHub repositories.

Human Factors

• Developer Configuration Errors: Developers accidentally set private repositories to public temporarily.
• Delayed Secret Rotation: Users failed to rotate compromised keys immediately after exposure.

Process and Methods

• Incomplete Vulnerability Patching: Microsoft blocked human UI cache access but left Copilot backend open.
• Lack of Real-Time Auth Checks: RAG pipelines did not verify live GitHub permissions before outputting data.

Information quality

• Classification confidence: High
• Reason for confidence: The reports from Lasso Security and TechCrunch provide clear, detailed, and consistent technical explanations of how the caching mechanism and Copilot retrieval worked. The scale of the exposure (20,580 repositories, 16,290 organizations) is explicitly quantified, and Microsoft's response and partial mitigation are documented.
• Ambiguities identified: Whether any malicious actors actually exploited this vulnerability to steal secrets before it was reported and partially patched.
• Alternative interpretations: The incident could be viewed purely as a search engine caching issue (Bing) rather than an AI safety issue, though Copilot's ability to bypass the disabled public cache links to retrieve the data makes it an AI-specific risk.

Microsoft Copilot was found to retrieve and expose sensitive 'zombie data' (cached private keys, secrets, and internal packages) from over 16,000 organizations, including major technology firms. This systemic data leakage highlights a critical vulnerability in AI-enabled search retrieval systems, posing substantial risks to international information security and technological competitiveness.

• Overall national security impact: Substantial
• Scope: Multiple nations
• Primary target: No clear primary
• Other affected: United States, China, and others
• Alleged perpetrator: Unknown

Threat characteristics

• Imminence: Long-term. Represents an ongoing strategic vulnerability in AI data retrieval and caching mechanisms rather than an active, imminent crisis.
• Autonomy: Human-controlled. The AI acts as an assistant answering user queries, but its backend data retrieval processes operated without sufficient human oversight.
• Novelty: Evolved capability. Significant advancement of data leakage risks, demonstrating how LLM search integrations can bypass traditional web access controls to retrieve deleted data.

Impact by dimension

• Physical security: Minor. No direct physical damage, but exposure of secrets at major tech and infrastructure-adjacent firms creates potential downstream vulnerabilities.
• Information security: Substantial. Exposed over 300 private tokens, keys, and secrets for platforms like GitHub, GCP, and OpenAI across 16,000+ organizations, creating significant espionage and data compromise risks.
• Sovereignty: Negligible. No evidence of direct impact on government decision-making, electoral systems, or sovereign state authority.
• Economic security: Substantial. Exposed proprietary code, internal packages, and secrets of major global tech companies (Intel, IBM, Huawei, Google), threatening technological security and intellectual property protection.
• Societal stability: Negligible. No direct threats to social cohesion, civil liberties, or population-scale stability identified in the incident.