Copilot vulnerability allowed unauthorized access to 2FA codes

2026-06-16

A newly discovered vulnerability, dubbed SearchLeak, in Microsoft Copilot has demonstrated a method for extracting two-factor authentication codes directly from user sessions, highlighting ongoing challenges in large language model security.

Source: Ars Technica

Reported by VERA Newswire.