Researchers turned Microsoft Copilot into a full reconnaissance tool using nothing but polite, innocent-sounding questions — and any AI assistant with broad access could do the same.
meta-hacking
+9
Stolen and resold AI accounts are turning shared logins into a surveillance channel nobody notices
Account Takeover
+6
One email is all it takes to plant a permanent lie in your AI assistant's memory — and there's no patch coming, because it isn't a bug.
identity-security
ConsentFix and ClickFix attacks are turning OAuth consent prompts into skeleton keys — no password theft, no MFA bypass required. Here's how they work and what to revoke today.
Microsoft 365
CISA left government cloud keys in public GitHub. Microsoft shipped a debug flag to 3 billion phones. Meta's AI gave away Instagram accounts. Same week.
identity
+5
The forensics always leads back to the same place — an account that shouldn't have existed, with access it shouldn't have had. Here's what to fix before the 2 AM alert.
+7
You clicked "Add to Chrome" because it promised to make you faster. You actually installed a wiretap.
chrome-extensions