4 ms·

I think you just defined away the entire category of vulnerability known as "privilege escalation".

• p_ing 1y ago
  This isn’t an example of escalation. Copilot is using the user’s token similar to any other OAuth app that needs to act on behalf of the user.
  • lokar 1y ago
    If that is true, then how did it not get logged? The audit should not be under the control of the program making the access.
    • p_ing 1y ago
      You're conflating two issues. The Purview search used to get the bad result wasn't clear, so unsure what system is doing the logging.