Critical Copilot vulnerability allowed hackers to seal 2FA code from users

Microsoft released an update last Tuesday to address a critical vulnerability in the M365 Copilot platform. Discovered by researchers, the flaw allows the retrieval of two-factor authentication codes and other sensitive data from emails. The issue arises from the AI models' inability to distinguish between user instructions and those embedded in external content. Microsoft and large language model providers face challenges in preventing their products from responding to malicious requests that expose data.