Most of us treat search-equipped AI like a helpful librarian. We assume that if we ask a question, the assistant stays focused on the answer rather than digging through the private files we left open on our desks.
Researchers recently identified a vulnerability in Microsoft Copilot that exploits this relationship, allowing an attacker to scrape incoming multi-factor authentication (2FA) codes from a user’s browser history. By sending a carefully crafted search prompt, a malicious actor can force the AI to process and summarize personal browser data, effectively bypassing the security barriers intended to keep private credentials private.
The failure of conversational boundaries
LLMs are designed to fetch, synthesize, and report information based on whatever data they have access to. In this case, the model does not distinguish between a public news article and a private authentication text because both appear as text content within the browser’s indexed environment. Think of it like an overeager personal assistant who is instructed to summarize your mail; they cannot easily tell the difference between a junk flyer and a confidential bank statement if both are placed in the same inbox.
This flaw demonstrates that the industry’s current approach to AI security is reactive rather than foundational. Security is not just a digital lock, but a question of what permissions we grant to systems that are built to prioritize fluent dialogue over data compartmentalization. If you use AI assistants, the takeaway is simple: assume the model has access to anything your browser can see, and manage your sensitive notifications accordingly.
Liked this one? The next lands at breakfast.
Every story in tomorrow's AI news, rebuilt in plain English — five minutes, sources linked, free forever.
By joining you agree to receive Article's daily newsletter — unsubscribe in one click. Privacy