# Critical Copilot vulnerability allowed hackers to seal 2FA code from users

Published: 2026-06-16 · Updated: 2026-06-16 · Category: Safety

Source page: https://www.sipply.dev/story/critical-copilot-vulnerability-allowed-hackers-to-seal-2fa-969e7b8d · 中文: https://www.sipply.dev/zh/story/critical-copilot-vulnerability-allowed-hackers-to-seal-2fa-969e7b8d

## Summary

A critical vulnerability in Microsoft's M365 Copilot AI platform has been identified, allowing hackers to extract two-factor authentication (2FA) codes and sensitive information from users' emails. This exploit took advantage of the AI's limitations in distinguishing between legitimate user instructions and malicious requests, raising significant concerns about the security of AI-driven tools. Microsoft has since issued a patch to address this vulnerability, emphasizing the importance of ongoing security measures in AI applications.

## Key takeaways

- A critical vulnerability in Microsoft's M365 Copilot allowed for the extraction of sensitive user data.
- The exploit highlights the challenges AI systems face in discerning between legitimate and malicious instructions.
- Microsoft has responded by patching the vulnerability, underscoring the need for continuous security updates.

## Why it matters

This incident underscores the vulnerabilities inherent in AI systems, particularly regarding user data security and the potential for exploitation. As AI tools become more integrated into daily workflows, ensuring their safety is paramount.

- **Product managers:** Product managers should prioritize security features in AI products and ensure that vulnerabilities are addressed promptly to maintain user trust and product integrity.
- **Developers:** Developers must be aware of the security implications of AI systems and implement robust safeguards to prevent similar exploits, focusing on improving the AI's ability to differentiate between legitimate and malicious inputs.
- **Students and job seekers:** For students and job-seekers, understanding the security challenges in AI development is crucial, as it highlights the importance of building secure applications and the growing demand for expertise in AI safety.

## Sources

- [Critical Copilot vulnerability allowed hackers to seal 2FA code from users](https://arstechnica.com/security/2026/06/critical-copilot-vulnerability-allowed-hackers-to-seal-2fa-code-from-users) (Ars Technica AI, 2026-06-16)

## 中文

### 关键的Copilot漏洞允许黑客窃取用户的2FA代码

在微软的M365 Copilot AI平台中发现了一个关键漏洞，允许黑客从用户的电子邮件中提取双因素认证（2FA）代码和敏感信息。该漏洞利用了AI在区分合法用户指令和恶意请求方面的局限性，令人对AI驱动工具的安全性产生重大担忧。微软已发布补丁以修复此漏洞，强调了在AI应用中持续安全措施的重要性。

**要点：**

- 微软的M365 Copilot中的关键漏洞允许提取敏感用户数据。
- 该漏洞突显了AI系统在区分合法和恶意指令方面面临的挑战。
- 微软通过修补漏洞作出回应，强调了持续安全更新的必要性。

**为什么重要：** 这一事件突显了AI系统固有的脆弱性，特别是在用户数据安全和潜在利用方面。随着AI工具越来越多地融入日常工作流程，确保其安全性至关重要。

---
Sipply: Sip AI News Simply. https://www.sipply.dev