3 ms·

If there is a product defect? Sure. The dude found the bug, reported the bug, they fixed the bug. This isn’t uncommon, there bugs like this frequently in comp

If there is a product defect? Sure. The dude found the bug, reported the bug, they fixed the bug. This isn’t uncommon, there bugs like this frequently in complex software.

gpm 1y ago
I think you just defined away the entire category of vulnerability known as "privilege escalation".
- p_ing 1y ago
  This isn’t an example of escalation. Copilot is using the user’s token similar to any other OAuth app that needs to act on behalf of the user.
  - lokar 1y ago
    If that is true, then how did it not get logged? The audit should not be under the control of the program making the access.
    - p_ing 1y ago
      You're conflating two issues. The Purview search used to get the bad result wasn't clear, so unsure what system is doing the logging.