Microsoft 365 Copilot Vulnerability Allegedly Allowed File Access Without Audit Log Entry

A vulnerability in Microsoft 365 Copilot reportedly allowed users to access and summarize files without generating audit log entries, allegedly undermining traceability and compliance. Security researcher Zack Korman disclosed the issue to Microsoft, which reportedly classified it as "important" and fixed it on August 17, 2025, but reportedly chose not to notify customers or assign a CVE.

What this means for youAt work, a company relying on Copilot's audit logs may have had gaps in its record of who opened which files, which matters for compliance. In government and regulated settings, missing logs weaken oversight. Check whether your Microsoft 365 admin has reviewed Copilot access logs for the affected period and applied the fix.