Microsoft Copilot kept thousands of once-private GitHub repositories accessible
Researchers found that Microsoft Copilot could still surface content from tens of thousands of GitHub repositories that had been public briefly and then made private, because the data lingered in a cached index, exposing secrets and code their owners believed were no longer reachable.
Copilot kept surfacing code and secrets from repositories whose owners had already made them private.
Key facts
- What
- Researchers found that Microsoft Copilot could still surface content from tens of thousands of GitHub repositories that had been public briefly and then made private, because the data lingered in a cached index, exposing secrets and code their owners believed were no longer reachable.
- Incident date
- Feb 26, 2025
- Who
- Microsoft
- Failure mode
- Data Leakage
- AI surface
- Copilot
- Severity
- High
What happened
In early 2025 security firm Lasso reported that Microsoft Copilot could return data from more than 20,000 GitHub repositories that were once public and later set private or deleted, because Bing's cache retained them. The exposed content included credentials and proprietary code from major companies. Microsoft and GitHub took steps to limit the cache after disclosure.
What broke inside the model
- 01 · TriggerA request triggers retrieval or context loading.
- 02 · Model stepThe context pulls in another user's content.
- 03 · Control gapNo boundary enforces isolation at the moment of output.
- 04 · FailurePrivate data crosses into the response.
- 05 · ConsequenceOne user sees another's data, and disclosure follows.
One user's content crosses the retrieval boundary into another's response.
The system surfaced data that should have stayed contained. The failure sits at the boundary between what the model can access and what it should reveal, a boundary that was never enforced at the moment of generation.
What it cost
Tens of thousands of private repositories exposed via the AI's cache
Sources
Cite this entry
https://failureindex.ai/failures/microsoft-copilot-kept-thousands-once-privateAI Failure Index. "Microsoft Copilot kept thousands of once-private GitHub repositories accessible" (FI-0073). Realm Labs. https://failureindex.ai/failures/microsoft-copilot-kept-thousands-once-private (indexed Jun 3, 2026).Data fields CC-BY 4.0, prose citation permitted. Incident ID FI-0073. Full dataset at /data.
Note from Realm Labs, the Index steward
How Realm would have caught this
- Prism
- OmniGuard
- AI Detection & Response (AIDR)
Realm can detect when a response is about to emit data outside the bounds of the current user and context, and block or redact it inline, at the moment of generation.