Source URL: https://yro.slashdot.org/story/25/02/27/2129241/thousands-of-exposed-github-repositories-now-private-can-still-be-accessed-through-copilot?utm_source=rss1.0mainlinkanon&utm_medium=feed
Source: Slashdot
Title: Thousands of Exposed GitHub Repositories, Now Private, Can Still Be Accessed Through Copilot
Feedly Summary:
AI Summary and Description: Yes
Summary: This text highlights significant security concerns raised by researchers regarding potential data exposure through generative AI tools like Microsoft Copilot. It underscores the persistence of data that can be accessed even after it has been made private, affecting major corporations.
Detailed Description: The content details a security warning from researchers about generative AI and its implications for data privacy and security. Key points include:
– **Data Persistence Issue**: Even data that is temporarily exposed to the internet can remain accessible via generative AI tools after being marked private.
– **Example Case**: The cybersecurity company Lasso discovered its own GitHub repository’s data appeared in Copilot even after it was set to private, suggesting Microsoft’s Bing search engine cached this data.
– **Scope of the Problem**: A substantial number of GitHub repositories—more than 20,000—were found to still have accessible data through Copilot, affecting over 16,000 organizations, including notable corporations such as Amazon Web Services, Google, IBM, PayPal, and Tencent.
– **Confidentiality Risks**: These exposed repositories can potentially include sensitive corporate information, intellectual property, and critical access credentials that could lead to significant security breaches.
**Implications for Security and Compliance Professionals**:
– The findings stress the importance of vigilant data management and understanding the lifecycle of data exposure, particularly in relation to AI and generative tools.
– Organizations must implement stringent practices for securing and monitoring access to their digital repositories to prevent unintended data leaks.
– This scenario raises questions about compliance and governance regarding data that may inadvertently remain accessible, underscoring a need for stringent privacy regulations.
In summary, this insight serves as a critical reminder for professionals in security, privacy, and compliance to assess the controls and governance surrounding their data in the age of generative AI technology.