Security vulnerabilities, privacy incidents, safety concerns, and policy updates affecting LLMs and AI agents.
Microsoft Kiota, a tool that generates AI plugin manifests from API descriptions, has a path traversal vulnerability (CWE-22, a security flaw where attackers access files outside intended directories) in how it validates file references. An attacker controlling the API description can use percent-encoding (a way of representing special characters as %XX codes) to bypass safety checks and reference files outside the plugin package, potentially exposing sensitive files like `/etc/passwd`. The initial fix in v1.32.5 failed because it checked the encoded string before decoding it, allowing attackers to hide traversal patterns in encoded form.
Fix: Upgrade to the first released `Microsoft.OpenApi.Kiota` version after 1.33.0 that includes the fixes from pull requests #7910 and #7913. The fix decodes percent-encoded references before validation, rejects control characters and NUL bytes (which could truncate paths), and applies NFKC-folding (a Unicode normalization technique) to catch homoglyph bypasses. Alternatively, only generate plugins from trusted API descriptions and manually review generated manifests to ensure `response_semantics.static_template.file` values are simple relative paths within the `adaptiveCards/` folder with no `..`, rooted paths, URIs, or percent-encoded separators.
GitHub Advisory DatabaseCVE-2026-50517 is a vulnerability in Microsoft 365 Copilot where deserialization (the process of converting stored data back into usable objects) of untrusted data allows an authorized attacker to execute code over a network. This means someone with legitimate access to the system could run malicious commands remotely by sending specially crafted data to the application.
Kiota, a tool that generates HTTP client code from API descriptions, had a security flaw in versions before 1.32.5 where it didn't properly validate file paths when creating plugin files. This allowed attackers to include specially crafted file paths that could access files outside the intended directory (path traversal, where attackers use ../ to escape folders) or include files from unexpected locations when the generated plugin was deployed.
CVE-2026-58617 is a vulnerability in Microsoft 365 Copilot for iOS that allows an unauthorized attacker to gain elevated privileges (higher access permissions) over a network due to improper access control (failing to properly verify who is allowed to do what in the system). The vulnerability has a CVSS score of 4.0, which indicates a moderate severity level.
CVE-2026-55145 is a command injection vulnerability (a type of attack where an attacker inserts malicious commands into user input) in Outlook Copilot that allows an authorized user to tamper with the system over a network. The vulnerability stems from improper handling of special characters in commands. The CVSS severity score (a 0-10 rating of how dangerous the vulnerability is) has not yet been assigned by NIST.
CVE-2026-50510 is a vulnerability in GitHub Copilot where improper file naming restrictions allow an unauthorized attacker to execute code on a user's local machine. The vulnerability is classified as CWE-641 (improper restriction of names for files and other resources), and details are being tracked by Microsoft and NIST.
CVE-2026-48561 is a command injection vulnerability (a flaw where an attacker tricks software into running unintended commands by inserting special characters into input) in Microsoft Copilot that allows an unauthorized attacker to execute code over a network. The vulnerability stems from improper handling of special elements in commands. Details about the severity and available fixes are still being assessed.
GitHub Copilot and Visual Studio Code contain a vulnerability where credentials (login information and authentication tokens) are not properly protected, allowing an attacker to access sensitive information over a network. This is tracked as CVE-2026-47282 and has a CVSS score (a 0-10 rating of how severe a vulnerability is) of 4.0, meaning it has moderate severity.
CVE-2026-45499 is a server-side request forgery vulnerability (SSRF, a flaw where an attacker tricks a server into making unwanted network requests) in Azure OpenAI that allows an authorized attacker to gain elevated privileges over a network. The vulnerability has a CVSS score (severity rating from 0-10) that has not yet been assigned by NIST. Microsoft has published information about this vulnerability on their security update page.
CVE-2026-41106 is an open redirect vulnerability (a flaw where a website redirects you to an untrusted site) in Microsoft 365 Copilot that allows an attacker to gain unauthorized elevated privileges (higher access levels) over a network. The vulnerability has a CVSS score (severity rating) of 4.0. This is an exclusive service issue affecting Microsoft 365 Copilot users.
CVE-2026-45482 is a path traversal vulnerability (a flaw where an attacker can access files outside the intended directory by manipulating file paths) in GitHub Copilot and Visual Studio Code that allows an unauthorized attacker to bypass a local security feature. The vulnerability has a CVSS 4.0 severity score (a 0-10 rating of how severe a vulnerability is, where higher numbers mean more serious). Details are still being assessed by NIST, and Microsoft has published information about this issue.
CVE-2026-47644 is an injection vulnerability (a flaw where specially crafted input is not properly filtered before being used by another part of the system) in Microsoft Edge's Copilot Chat that allows an attacker to disclose information over a network without authorization. The vulnerability involves improper neutralization of special elements in output, meaning the system doesn't properly clean or validate data before passing it to other components.
CVE-2026-45497 is a command injection (a flaw where special characters in user input are not properly filtered, allowing an attacker to insert and run unintended commands) vulnerability in Microsoft Copilot that lets an authorized attacker execute code over a network. The vulnerability has not yet received a CVSS score (a 0-10 rating of how severe a vulnerability is) from NIST.
CVE-2026-42824 is a command injection vulnerability (a flaw where an attacker inserts malicious commands into user input that gets executed by the system) in Microsoft 365 Copilot that allows an unauthorized attacker to disclose information over a network. The vulnerability stems from improper neutralization of special elements in commands. A CVSS score (a 0-10 rating of how severe a vulnerability is) has not yet been assigned by NIST.
Microsoft APM is a tool that manages dependencies for AI agents, and versions before 0.13.0 have a security flaw on Windows systems. When installing a bundle (a package of code) from a .tar.gz file (a compressed archive format), the tool extracts files without properly checking if any file paths could escape the intended folder, potentially allowing an attacker to place files anywhere on the system by using absolute paths like D:/.
Microsoft APM, a dependency manager for AI agents, had a vulnerability in versions 0.5.4 to 0.12.4 where symbolic links (shortcuts that point to other files) in downloaded packages were followed without checking, potentially allowing attackers to read or write arbitrary files on a developer's machine. The vulnerability went undetected by security checks because the resulting files were not flagged by the package hash verification, security scans, or audit tools.
Microsoft APM is a tool that manages dependencies (external code libraries) for AI agents. Before version 0.8.12, it had a path traversal vulnerability (a security flaw where an attacker can access files outside the intended directory) that allowed malicious plugins to copy arbitrary files from a user's computer during installation by using absolute paths or '../' sequences to escape the plugin directory.
GitHub Copilot CLI (an AI tool that helps developers write code from the command line) has a security vulnerability in versions before 1.0.43 where a malicious bare git repository (a special type of git storage folder with no working files) hidden in a project can trick the tool into running harmful commands. An attacker can exploit git's automatic discovery of these repositories and use configuration keys like core.fsmonitor (settings that tell git what commands to run during normal operations) to execute arbitrary code without the user knowing.
Microsoft SharePoint has a deserialization of untrusted data vulnerability (a flaw where the software unsafely processes data from untrusted sources, potentially allowing attackers to run malicious code). An unauthorized attacker could exploit this over a network to execute code on affected systems. This vulnerability is currently being actively exploited in real-world attacks.
Fix: Apply mitigations in accordance with vendor instructions from Microsoft, following CISA's BOD 26-04 guidance for prioritizing security updates based on risk. For cloud services, follow applicable BOD 26-04 guidance or discontinue use of the product if mitigations are unavailable. Stakeholders must evaluate each system's internet exposure and ensure adherence to BOD 26-04 patching guidelines by the due date of 2026-07-25. See Microsoft Security Response Center (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50522) for specific vendor instructions.
CISA Known Exploited VulnerabilitiesFix: Update Kiota to version 1.32.5 or later, which fixes this issue.
NVD/CVE DatabaseMicrosoft SharePoint Server has a deserialization of untrusted data vulnerability (a flaw where the software unsafely processes data from an untrusted source, allowing an attacker to inject malicious code), which lets an authorized attacker run code over a network. This vulnerability is actively being exploited in real attacks. Organizations must apply security updates following CISA's BOD 26-04 guidance by July 4, 2026, or stop using the product if no fix is available.
Fix: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA's BOD 26-04 Prioritizing Security Updates Based on Risk guidance. Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. See https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45659 for vendor-specific details and https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk for patching guidelines.
CISA Known Exploited VulnerabilitiesFix: This vulnerability is fixed in version 0.13.0.
NVD/CVE DatabaseFix: This vulnerability is fixed in version 0.13.0.
NVD/CVE DatabaseFix: This vulnerability is fixed in version 0.8.12. Users should update Microsoft APM to 0.8.12 or later.
NVD/CVE DatabaseFix: Update GitHub Copilot CLI to version 1.0.43 or later, where this vulnerability is fixed.
NVD/CVE Database