Microsoft Copilot

Researchers identified a critical vulnerability named CosmosEscape that allowed for unauthorized access to Azure Cosmos DB accounts. By bypassing the Gremlin API sandbox, attackers could have leveraged a platform-wide master key to compromise both customer and Microsoft internal databases.

Microsoft's latest Patch Tuesday includes a record 570 security fixes, highlighting a surge in vulnerabilities found via AI-assisted research. The update addresses several critical flaws and zero-days that are actively being exploited by malicious actors.

Researchers have identified a critical vulnerability chain called SearchLeak that allows attackers to exfiltrate enterprise data via Microsoft 365 Copilot. By combining prompt injection with an HTML race condition and Bing-based SSRF, attackers can bypass security controls with a single click.

The article critiques the unsustainable economic model of the current AI boom, arguing that the massive capital expenditures by hyperscalers like Microsoft and Amazon are not matched by sufficient, consistent revenue streams. The author stresses that for AI to be profitable, revenue must explode dramatically, and the operational costs (OpEx) of running data centers must be accounted for.