Critical Copilot Vulnerability Let Hackers Steal 2FA Codes from Users
Ars Technica AI42 days agoIncidentA critical vulnerability in Microsoft Copilot, named SearchLeak, allowed malicious actors to steal two-factor authentication codes from users — among the most sensitive short-lived credentials in any security workflow. The exploit exposes a recurring weakness in LLM-integrated products: AI assistants with broad data access create novel attack surfaces that conventional security models fail to contain. Ars Technica frames the incident as evidence of the AI industry's persistent, systemic inability to get ahead of LLM-specific security threats.
Meta confirms thousands of Instagram accounts hacked via AI chatbot abuse★ 76
Hacker News (AI keywords)51 days agoIncidentMeta confirmed a vulnerability in Instagram’s AI-assisted account recovery system that let attackers redirect password reset links to attacker-controlled emails. At least 20,225 users were notified, with compromised accounts potentially exposing profile data, posts, direct messages, and activity. Meta says it has disabled the affected chatbot flow, removed the vulnerable code path, and asked impacted users to reset passwords through verified channels.