Microsoft Copilot kept thousands of once-private GitHub repositories accessible

Researchers found that Microsoft Copilot could still surface content from tens of thousands of GitHub repositories that had been public briefly and then made private, because the data lingered in a cached index, exposing secrets and code their owners believed were no longer reachable.

Microsoft · Incident Feb 26, 2025 · Indexed Jun 3, 2026 · 2 sources

Copilot kept surfacing code and secrets from repositories whose owners had already made them private.
What
Researchers found that Microsoft Copilot could still surface content from tens of thousands of GitHub repositories that had been public briefly and then made private, because the data lingered in a cached index, exposing secrets and code their owners believed were no longer reachable.
Incident date
Feb 26, 2025
Who
Microsoft
Failure mode
Data Leakage
AI surface
Copilot
Severity
High

What happened

In early 2025 security firm Lasso reported that Microsoft Copilot could return data from more than 20,000 GitHub repositories that were once public and later set private or deleted, because Bing's cache retained them. The exposed content included credentials and proprietary code from major companies. Microsoft and GitHub took steps to limit the cache after disclosure.

What broke inside the model

Failure path · mode profile · Data Leakage
  1. 01 · TriggerA request triggers retrieval or context loading.
  2. 02 · Model stepThe context pulls in another user's content.
  3. 03 · Control gapNo boundary enforces isolation at the moment of output.
  4. 04 · FailurePrivate data crosses into the response.
  5. 05 · ConsequenceOne user sees another's data, and disclosure follows.

One user's content crosses the retrieval boundary into another's response.

The system surfaced data that should have stayed contained. The failure sits at the boundary between what the model can access and what it should reveal, a boundary that was never enforced at the moment of generation.

Public visibilityHigh
Regulatory exposurePossible
Customer impactMany customers
Financial impactEstimated
Time to disclosureWeeks

Tens of thousands of private repositories exposed via the AI's cache

  1. PressThousands of exposed GitHub repositories, now private, can still be accessed through Copilottechcrunch.com
  2. PressTens of thousands of once-private GitHub repos are still accessible through Microsoft Copilot (TechCrunch)techcrunch.com
Permalinkhttps://failureindex.ai/failures/microsoft-copilot-kept-thousands-once-private
CitationAI Failure Index. "Microsoft Copilot kept thousands of once-private GitHub repositories accessible" (FI-0073). Realm Labs. https://failureindex.ai/failures/microsoft-copilot-kept-thousands-once-private (indexed Jun 3, 2026).
Share cardA branded image of this record for posts and slides.

Data fields CC-BY 4.0, prose citation permitted. Incident ID FI-0073. Full dataset at /data.

Note from Realm Labs, the Index steward

How Realm would have caught this

Controls for this failure mode
  • Prism
  • OmniGuard
  • AI Detection & Response (AIDR)

Realm can detect when a response is about to emit data outside the bounds of the current user and context, and block or redact it inline, at the moment of generation.