Disclosed vulnerability
Realized harm
Wayback Copilot: Microsoft Copilot served content from GitHub repositories that had since been made private
AIR-2025-0010 AIR record · 2025-02-microsoft-copilot-wayback-private-repos
A real party was affected. This incident caused actual consequences, not a demonstrated capability.
From the supporting source
Our suspicions were confirmed when Copilot returned actual data from the time when the repository was public, seemingly retrieving a cached snapshot of “Zombie Data” - data that the user think is private or deleted, but is still accessible.lasso.security
The record
Disclosed
2025-02-26
Vendor
Microsoft
Product
Microsoft Copilot (Bing-backed retrieval)
Risk domain
Access control and permissions › Credential theft
Also touches
Sensitive data exposure
System type
Generative model
Who acted
Agent acted (contested) — Copilot retrieved and served the stale private repository content on request
Attack surface
Enterprise assistant
Autonomy level
Assistant
Initial vector
Retrieval from stale search cache
Impact type
Data exposure, Credential theft
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI03 – Identity and Privilege Abuse
- MITRE ATLAS
- AML.T0012 – Valid Accounts
- NIST AI RMF
- MEASURE 2.7
- EU AI Act
- Article 13
- ISO/IEC
- TR 24028; 42001; 23894
- AIUC-1
- B. Security
- Scope
- tool failure
- Mitigation
- Use secure credential storage; Implement short-lived tokens.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
20,580 repositories from 16,290 organizations were identified through the caching mechanism; the researchers also found 300+ private tokens, keys, and secrets
Capability abused
Defense & remediation
Recorded defense
repository visibility controls on GitHub
Guardrail kinds
Unknown
Guardrail outcome
Silent
Fix shipped
partial mitigation; Microsoft classified the issue as low severity
Taxonomy & references
Curator notes
Lasso Security demonstrated that Copilot could return actual cached contents from repositories that had become private, then scaled the search and reported 20,580 repositories, 16,290 affected organizations, and 300+ private tokens, keys, and secrets. AI Incident Database incident 1174.
Supporting sources
Cite as
Enkrypt AI. "Wayback Copilot: Microsoft Copilot served content from GitHub repositories that had since been made private". AIR, AIR-2025-0010. https://agentincident.vercel.app/i/AIR-2025-0010/ (accessed 2026-10-19).