Microsoft patches Surface firmware flaw discovered by Copilot that could brick devices

Microsoft quietly patched a firmware flaw in Surface devices over the past 90 days that could brick hardware with a single packet, but only when Secure Core and Secure Boot were disabled.

Jack Darcy, a security researcher in Australia, reported that Microsoft Copilot inadvertently helped identify the bug while adjusting screen backlighting.

Copilot generated and executed Python scripts that rendered his laptop inoperable by overwriting embedded controller firmware.

The SAM/SSAM embedded controller in Surface devices lacked defenses against arbitrary write values, enabling firmware vandalism without the usual physical access checks.

Microsoft stated there is no realistic attack scenario because exploitation would require specific drivers, hardware interface command access, administrator privileges, and disabling Secure Boot.