Dorothea Salo @dsalo@digipres.club
Quiet public

So this is Microsoft's new emphasis on security, is it?

Okaaaaaaaaaaaay.

Because Microsoft has NEVER had security problems related to service accounts before. Nope. Never ever. They couldn't possibly have known.

mastodon.social/@mhoye/1144730

mhoye (@mhoye@mastodon.social)

https://www.pentestpartners.com/security-blog/exploiting-copilot-ai-for-sharepoint/ Something to be aware of if you work in a Microsoft shop with security requirements: Copilot on Sharepoint will apparently allow ACL bypass without logging or alerting. You can just ask it for things. It looks like what's going on under the hood here is that Copilot introduces a new category of user account for their agents, who have expansive read permissions by default and Copilot doesn't know how to map what the agent _can_ read against user permissions.

mastodon.social · Mastodon

0
0
0

If you have a fediverse account, you can quote this note from your own instance. Search https://digipres.club/users/dsalo/statuses/114473421058808756 on your instance and quote it. (Note that quoting is not supported in Mastodon.)