Critical Microsoft Copilot Vulnerability: How 2FA Codes Get Stolen

The M365 Copilot vulnerability that Microsoft patched last Tuesday had been rated at maximum severity. On Monday, the researchers who discovered and reported it published a proof-of-concept exploit, "SearchLeak," showing how it can extract 2FA codes and sensitive data from emails accessible through Copilot.

At the root of the issue lies a structural weakness: LLMs cannot distinguish between instructions from the user and malicious instructions embedded in third-party content. LLM providers, Microsoft included, have yet to find a way to fundamentally prevent this "blind obedience," and continue to cope with it through elaborate, piecemeal guardrails. The data exfiltration technique, which leveraged markup languages and HTML tags, was clever enough to bypass conventional form-submission blocking.

This case underscores how approaches to LLM security keep failing.

Anthropic Faces Class Action Over Claude AI Pricing

Anthropic is facing a lawsuit alleging that Claude AI's pricing was misleading. The complaint argues that actual charges differed significantly from the prices presented to consumers. Details have not been reported, but it is worth noting that consumer distrust of AI service pricing has now taken legal form.

Recent reports suggest Claude's pricing is shifting from flat-rate subscriptions to usage-based billing, and this lawsuit could influence that trajectory.

Databricks' Data Warehouse Business Reaches $1.5 Billion Scale

Databricks announced that annual revenue for its data warehouse business, which competes with Snowflake and Google, has more than doubled year over year, reaching a $1.5 billion annual run rate. CEO Ali Ghodsi said demand for AI workloads and migrations from other platforms are driving the growth.

Reaching this scale while still private shows that AI infrastructure demand is delivering substantial revenue to the data processing layer as well.

Man Group Warns of an "AI Bond Bubble"

Man Group, one of the world's largest hedge funds, warned that "bubble risk" is building up in the surge of bond issuance accompanying the AI infrastructure buildout race. The firm's Sriram Reddy and others noted that "fervor for the sector has led to a significant overshoot." They are particularly concerned about issuance in the high-yield bond and loan markets, noting that many borrowers remain free-cash-flow negative.

Behind the AI investment boom, voices pointing to overheating in financial markets are beginning to emerge.

Estonian Language Institute Releases Benchmark Testing AI Against Russian Propaganda

The Institute of the Estonian Language has released a benchmark that measures how susceptible AI language models are to Russian propaganda. The benchmark appears to systematically evaluate how resistant LLMs are to deliberate disinformation. Specific results await the full paper, but as an attempt to measure generative AI's resilience to information manipulation, it is a significant undertaking directly tied to the question of AI trustworthiness in democratic societies.

Mistral AI Explores a Palantir-Style Partnership with Ukraine

France's Mistral AI is reportedly working to establish a Palantir-style military and defense partnership with Ukraine. The move is drawing attention as a European AI company making a serious push into the defense sector. The details were reported by the paywalled outlet Intelligence Online, and they suggest that Mistral AI has its sights set not only on developing commercial LLMs but also on deployment for government and military use.

---