Security vulnerabilities, privacy incidents, safety concerns, and policy updates affecting LLMs and AI agents.
A flaw in Microsoft 365 Copilot's permission settings allows someone with authorized access to improperly view sensitive information across a network. The issue stems from incorrect assignment of permissions (access rules) to a critical resource (important data or system component), meaning the AI tool isn't properly restricting who can see what.
M365 Copilot has a command injection vulnerability (a flaw where special characters in user input can trick the system into running unintended commands), which allows an authorized attacker to gain higher privileges over a network. The vulnerability affects users who already have some level of access to the system.
Microsoft 365 Copilot's Business Chat has a vulnerability where special characters are not properly filtered before being used in commands, allowing attackers to inject malicious commands (command injection, where an attacker sneaks unauthorized instructions into a system by exploiting how it processes input). This could let unauthorized people access and steal sensitive information across the network.
Azure Machine Learning contains a vulnerability where authorization checks (the system that verifies whether a user is allowed to perform an action) are not working correctly, allowing an attacker without permission to access and steal sensitive information over the internet.
Microsoft Copilot has a command injection vulnerability (a flaw where special characters in user input are not properly filtered, allowing attackers to execute unintended commands), which lets an unauthorized attacker access and leak sensitive information over a network.
The Windows ML CLI tool exposes commands over HTTP on localhost without authentication and sets CORS (cross-origin resource sharing, which controls what websites can access a server) to allow all origins via a wildcard. This means any website you visit can call the CLI endpoint, and if you use the '--trust-remote-code' flag with a malicious model repository, an attacker can execute arbitrary code on your computer when the server imports that model.
GitHub Copilot and Visual Studio Code have a security flaw where credentials (secret login information) are not properly protected, allowing an attacker on a network to steal and expose this sensitive data.
GitHub Copilot and Visual Studio Code have a vulnerability where special characters in commands aren't properly filtered, allowing an attacker to inject malicious commands (command injection, where an attacker manipulates input to run unintended commands) and access sensitive information over a network.
ms-swift 4.5.2 has a server-side request forgery vulnerability (SSRF, where an attacker tricks a server into making requests to places it shouldn't), in its OpenAI-compatible API that handles media files. Attackers without authentication can provide fake image, audio, or video URLs that force the server to request internal services and cloud metadata, potentially exposing sensitive information.
Copilot Studio has a security flaw where it fails to properly verify cryptographic signatures (mathematical proofs that data comes from a trusted source), allowing an attacker to gain elevated privileges (higher access levels) on a network without authorization.
OpenAI's ChatGPT Work (an enterprise AI agent) and Microsoft Outlook both experienced outages on Monday, with users unable to access or use these services for several hours. OpenAI reported elevated errors and latency in ChatGPT Work, while Microsoft had issues with Exchange Online (the cloud service that powers Outlook), though the outages appeared to be unrelated.
A race condition (a bug where two processes access the same resource at the same time, causing unpredictable behavior) exists in Microsoft Edge's Copilot Chat feature that allows an authorized attacker to leak sensitive information over a network.
CVE-2026-69855 is a server-side request forgery vulnerability (SSRF, a flaw that lets attackers trick a server into making requests to internal systems) in Microsoft Copilot running on Azure. An authorized attacker can exploit this to leak sensitive information across a network.
CVE-2026-24301 is a command injection vulnerability (a weakness where an attacker hides malicious commands in user input to trick a program into executing them) in Microsoft Copilot that allows an unauthorized attacker to access and steal information over a network. The vulnerability stems from improper neutralization of special elements used in commands. The CVSS severity score (a 0-10 rating of how dangerous a vulnerability is) has not yet been assigned by NIST.
CVE-2026-70335 is a vulnerability in GitHub Copilot and Visual Studio Code that allows improper neutralization of special elements in OS commands (OS command injection, where an attacker can execute arbitrary system commands). An unauthorized attacker could exploit this to elevate their privileges locally on an affected system.
CVE-2026-65675 is a vulnerability in Visual Studio Code's CoPilot Chat Extension that allows an unauthorized attacker to bypass a security feature over a network. The vulnerability has not yet been assigned a complete severity rating or detailed weakness classification by NIST.
Microsoft Kiota, a tool that generates AI plugin manifests from API descriptions, has a path traversal vulnerability (CWE-22, a security flaw where attackers access files outside intended directories) in how it validates file references. An attacker controlling the API description can use percent-encoding (a way of representing special characters as %XX codes) to bypass safety checks and reference files outside the plugin package, potentially exposing sensitive files like `/etc/passwd`. The initial fix in v1.32.5 failed because it checked the encoded string before decoding it, allowing attackers to hide traversal patterns in encoded form.
CVE-2026-50517 is a vulnerability in Microsoft 365 Copilot where deserialization (the process of converting stored data back into usable objects) of untrusted data allows an authorized attacker to execute code over a network. This means someone with legitimate access to the system could run malicious commands remotely by sending specially crafted data to the application.
Fix: OpenAI stated it was 'continuing work on implementing a mitigation' and that the team was 'working on a fix.' Microsoft said it was 'reviewing service telemetry and diagnostic data to isolate the source of the issue,' but no specific fix or timeline was provided in the source text.
CNBC TechnologyMicrosoft Entra ID (formerly called Azure Active Directory, which manages user identities and access) has a deserialization of untrusted data vulnerability (a flaw where the software unsafely processes data from untrusted sources, allowing attackers to run malicious code). An attacker could exploit this over a network to execute code without authorization, and this vulnerability is currently being exploited by real attackers.
Fix: Apply mitigations according to Microsoft's vendor instructions while following CISA's BOD 26-04 (Prioritizing Security Updates Based on Risk) guidance. For cloud services, follow BOD 26-04 guidance for cloud environments, or discontinue use of the product if mitigations are unavailable. Organizations must evaluate their systems' internet exposure and ensure they meet BOD 26-04 patching requirements by the due date of 2026-08-24.
CISA Known Exploited VulnerabilitiesMicrosoft SharePoint has a weak authentication vulnerability that allows attackers to bypass security features over a network without proper credentials. This flaw is currently being exploited by real attackers. Organizations must apply patches according to Microsoft's instructions and follow CISA's BOD 26-04 guidance (a federal directive for prioritizing security updates), or stop using the product if no fix is available.
Fix: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA's BOD 26-04 guidance. For cloud services, follow applicable BOD 26-04 guidance or discontinue use of the product if mitigations are unavailable. See Microsoft Security Response Center (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55040) for specific patches. Due date for patching: 2026-08-21.
CISA Known Exploited VulnerabilitiesFix: Upgrade to the first released `Microsoft.OpenApi.Kiota` version after 1.33.0 that includes the fixes from pull requests #7910 and #7913. The fix decodes percent-encoded references before validation, rejects control characters and NUL bytes (which could truncate paths), and applies NFKC-folding (a Unicode normalization technique) to catch homoglyph bypasses. Alternatively, only generate plugins from trusted API descriptions and manually review generated manifests to ensure `response_semantics.static_template.file` values are simple relative paths within the `adaptiveCards/` folder with no `..`, rooted paths, URIs, or percent-encoded separators.
GitHub Advisory Database