Microsoft Copilot Security Vulnerability Allows File Access Without Audit Logging

Summary

A security researcher discovered a critical vulnerability in Microsoft's Copilot AI where the system can access and retrieve information from files without generating audit log entries, effectively creating invisible access that bypasses security monitoring. The researcher found they could deliberately trigger this behavior by asking Copilot to access files without logging, and Microsoft has been aware of the issue for months but hasn't publicly disclosed or fixed it, creating significant security risks for organizations relying on audit logs for compliance and security monitoring.