Microsoft Copilot Reportedly Able to Access Cached Data from Since-Private GitHub Repositories

Lasso Security reported that Microsoft Copilot could return content from GitHub repositories that had been public briefly but later set to private or deleted. Lasso attributed this to Bing's caching system, which stored "zombie data" from over 20,000 repositories. The cached content allegedly included sensitive information such as access keys, tokens, and internal packages. Microsoft reportedly classified the issue as low severity and applied only partial mitigations.

What this means for youAt home and at work, anything once posted publicly, even briefly, may stay retrievable through AI tools, so keys or passwords posted by mistake must be treated as leaked and replaced. Governments and companies should expect AI search tools to expose old cached data. Check any code you have published, and rotate any keys or tokens that were ever public.