Unverified50% confidenceEventExact time
Microsoft Copilot experienced a zero-click incident in which hidden instructions were encountered while retrieving internal documents, causing private content it could access to be leaked.
1
Sources
50%
Confidence
Medium-term (~90 days)
Relevance
9/25/2026
First Seen
Valid until: 12/24/2026
Sources
Related Entities
Related Claims
UnverifiedMicrosoft rated the Copilot vulnerability as Low Severity and carried out partial fixes—such as restricting Copilot's ability to render clickable hyperlinks—but the fundamental attack vector for data exfiltration has not been fully eliminated.66% similarUnverifiedRecently unsealed unredacted court documents show that Microsoft internally referred to OpenAI's data practices as 'theft' in private.65% similarUnverifiedThe patch pushed by Microsoft addressed known security vulnerabilities in the Windows operating system and Excel, but after deployment it caused three categories of issues: abnormal audio output, blocked remote access, and broken clipboard paste functionality.60% similarUnverifiedA Windows Defender full-disk scan of the malware reported 0 threats, failing to detect the infection.58% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/948687API
curl https://kongchang.com/api/v1/knowledge/claims/948687MCP
get_claim(id=948687)