Using Microsoft's Copilot to Expose Private GitHub Repositories

What a great article!

Note that this only exposes the repositories that were public at one point, then made private. While they were public, the contents got indexed and the ever-data-hungry models can still access this indexation.

We informed Microsoft of our findings, outlining that deleted or private GitHub repositories were still accessible through Bing’s cache and Copilot and that this functionality posed a security risk by exposing organizational data. We also alerted all affected organizations and advised them to rotate or revoke any compromised keys.

Microsoft classified the issue as low severity, citing its "low impact" and asserting that this caching behavior was acceptable. Nevertheless, they responded quickly and within a two weeks, Bing’s cached link feature was removed, and access to the cc.bingj.com domain was disabled for all users.

From the article, I'd probably disagree on the low impact, but nontheless the response is reasonable.