Ages2Come
Menu
View all results →
Categories
⚡ Breaking
Fake 10 Downing Street listing exposes 'unfit' Booking.com, says consumer group Massachusetts’ 80-year-old senator sees off primary challenge over his age Pentagon chaos deepens after Driscoll quits in clash with Hegseth Incumbent Sen. Ed Markey wins Massachusetts' Democratic primary for US Senate Apple Maps changes Lake Ontario to Lake America after Trump order Larry Page’s flying car company Pivotal loses its CEO Bill Simmons’s Co-Hosts Are Tired of His A.I. Antics SEC proposes transfer agent rule, sets event to figure out round-the-clock U.S. trading China dissented from G20 statement opposing 'cheap exports' flooding market, Bessent says Tim Cook to be paid $47mn as Apple’s executive chair Fake 10 Downing Street listing exposes 'unfit' Booking.com, says consumer group Massachusetts’ 80-year-old senator sees off primary challenge over his age Pentagon chaos deepens after Driscoll quits in clash with Hegseth Incumbent Sen. Ed Markey wins Massachusetts' Democratic primary for US Senate Apple Maps changes Lake Ontario to Lake America after Trump order Larry Page’s flying car company Pivotal loses its CEO Bill Simmons’s Co-Hosts Are Tired of His A.I. Antics SEC proposes transfer agent rule, sets event to figure out round-the-clock U.S. trading China dissented from G20 statement opposing 'cheap exports' flooding market, Bessent says Tim Cook to be paid $47mn as Apple’s executive chair
AI / Automotive Automotive

Copilot searched your mailbox. LiteLLM handed out admin keys. Run this 5-check audit before your stack is next

Source: ventureBeat June 18, 2026 · 10:42
Two AI tools broke in the same way in the same two weeks, and four research teams proved it. The pattern underneath every disclosure is one sentence: enterprise AI accepts external input with no trust boundary. On June 15, Varonis disclosed SearchLeak (CVE-2026-42824), a proof-of-concept exfiltration chain in Microsoft 365 Copilot Enterprise Search. A victim clicks a crafted microsoft.com URL, Copilot searches their mailbox, and the data leaves through a Bing SSRF. No plugins, no second click, no visible indicator. Four days earlier, Obsidian Security published a three-CVE chain against LiteLLM that carried a default low-privilege user all the way to admin and remote code execution. Two tools. Two teams. One broken boundary.The five-check audit at the end of this article maps each gap to a…
Read original article ← Back to Automotive

The original article opens on the publisher's website.

More from Automotive

View topic →
Countries mentioned
United States