Copilot Showed Me My Coworker's Files (It Wasn't Hacked)

A security researcher at CD Security Lab demonstrated that Microsoft 365 Copilot surfaced an HR salary review to a user during a trial deployment without any breach, because Copilot only exposes content the user could already open and years of "share with everyone" links left the data reachable. The researcher outlined a three-step remediation: measure exposure with SharePoint data access governance reports, apply Restricted Content Discovery to limit access, then clean up sharing permissions and label sensitive files, noting that disabling Copilot does not close any of the underlying access paths.

In the first week of a Microsoft 365 Copilot trial, a normal question returned a summary of the HR salary review. Nothing was hacked: Copilot only surfaces what the user could already open, and years of "share with everyone" links did the rest. This video shows who gets hurt, where the open doors came from, and the three-step fix: measure with the SharePoint data access governance reports, pull the brake with Restricted Content Discovery, then clean up the sharing itself and label the crown jewels. And why turning Copilot off does not close a single door. Lab names and made-up numbers only contoso.com . No prices: they change by region. Have you run the oversharing reports in your tenant before rolling out Copilot? Tell me in the comments, or watch the full video here: https://youtu.be/HvuBSAHcJuk https://youtu.be/HvuBSAHcJuk Thanks for reading I'm Cuong, and on CD Security Lab I rebuild real Microsoft security cases in a safe lab and explain them simply. Follow along: Got a question about your own tenant? Drop it in the comments.