Copilot Told Hackers How to Hack It

Security researchers at Varonis wanted to know if they could get Microsoft 365 Copilot — Microsoft's AI assistant built into Office and enterprise tools — to steal user data automatically, the moment a target clicked a malicious link. Copilot initially refused. What happened next is the part worth paying attention to.

Rather than reverse-engineering the software, the researchers simply kept asking Copilot questions about why it was refusing. Why did certain actions need user confirmation? What URL structures were involved? What happens when a page loads with text already in the input field? Each refusal came with an explanation, and each explanation handed the researchers a little more of the map, according to Ars Technica.

Eventually, Copilot disclosed a previously undocumented internal parameter — a hidden setting that completely bypassed the requirement for a user to confirm before commands ran. The string was ?autorun=1. Combined with a second, publicly known parameter, it caused Copilot to silently execute a crafted prompt the instant someone clicked a link. No key press. No confirmation. User passwords and sensitive data could be pulled out without the victim doing anything beyond opening a URL.

Microsoft quietly fixed the initial bypass in February, three months after the disclosure. More comprehensive fixes arrived this week.

If your organisation uses Microsoft 365 Copilot, confirm with your IT team that the Tuesday patches have been applied. There is no action required from individual users, but it is worth knowing this happened.

Meta AI is a chatbot from Meta — the company behind Facebook and Instagram — that competes with ChatGPT and Google's Gemini. Until now, it lived mainly in mobile apps and on the web. According to The Verge, Meta has now launched a standalone Mac desktop app.

The headline feature: you can share your screen with it. Point it at a document, a spreadsheet, or a browser window, and it can answer questions or draft content based on what it sees. It also supports dictation across all apps on your Mac.

For businesses and creators, the app connects to Instagram, Facebook, Google Workspace, and Meta ad accounts. It can analyse post performance and suggest what to publish next, or generate reports and presentations from your account data.

The app is free. It does not yet offer the deeper computer control that ChatGPT and Claude's Mac apps provide — those can take actions on your machine; Meta AI can only see and respond.

Honest read: Worth trying if you are already in the Meta ecosystem and want a desktop AI assistant, but it trails competitors on capability until screen interaction becomes two-way.

What it is: A set of small, compressed AI models from Liquid AI, designed to run on everyday devices like laptops, phones, and Raspberry Pi boards.

What's new: Most compressed models lose meaningful accuracy in the process. Liquid AI's approach recovers nearly all of it while keeping the same small file size and fast speed as a standard compressed model.

How it works: The technique is called Quantization-Aware Distillation (QAD). Quantization (shrinking a model by reducing the numerical precision of its internal values, the way you'd compress a photo to a smaller file) typically costs accuracy. QAD counters this by running a full-precision "teacher" model alongside a compressed "student" model during training. The student learns to match the teacher's outputs precisely, rather than just being squashed down after the fact. The result is a model that fits in the same memory as a standard compressed file but behaves closer to the full-size original.

What it can't do: According to Liquid AI's own benchmarks — covering reasoning, instruction-following, and tool use across sets including GPQA Diamond (a graduate-level science question set) and MMLU-Pro — the QAD models recover around 97% of the accuracy lost through standard compression. Frontier-scale models were not tested; all four models here are small, ranging from 230 million to 2.6 billion parameters (the numerical values that define a model's behaviour).

Who should care: Developers and hobbyists who want a capable AI model running locally, without cloud costs or privacy trade-offs.

Try it / read it: Hugging Face — LFM2.5 QAD

Replit is a browser-based platform that lets you build and run software without installing anything. Previously, using its AI-powered features cost credits. Replit has now launched Free Mode, powered by GPT‑5.6 Luna (an OpenAI model from the GPT‑5.6 series), which lets anyone plan, prototype, and explore software ideas without consuming a usage budget, according to OpenAI's announcement.

In practice: you describe what you want to build in plain language, and Replit's AI helps you shape and develop it. When a task needs heavier reasoning, it routes to a more capable model, then returns to Free Mode automatically.

To get started, go to replit.com, create a free account, and open a new project. Free Mode is available without any payment details.

Worth knowing: Free Mode covers exploration and planning — actually deploying or running your finished app moves you into Replit's paid Build Mode, so check the pricing before you get attached to a project.

OpenAI has temporarily slowed the pace of scaling its most capable models, including a two-week pause on reinforcement learning (RL) training — a technique that teaches models to improve through feedback — on models intended for deployment, according to OpenAI's own statement.

The trigger: preliminary evidence that Astra, one of OpenAI's upcoming models, may meet what OpenAI calls a "Critical cybersecurity capability threshold" under its internal risk framework. The company says it is hardening its research environments and expanding monitoring before proceeding. Its largest planned frontier training run remains on hold.

For ordinary users, nothing changes today. What matters is that a major AI lab has publicly acknowledged pausing development because of a model's potential to cause real-world harm.