Home › AI Tools › Copilot searched your mailbox, LiteLLM leaked admin keys – run a 5‑check audit

Copilot searched your mailbox, LiteLLM leaked admin keys – run a 5‑check audit

📅 June 22, 2026 👁 alfonews 🏷 AI Tools

Photo by Mikhail Nilov on Pexels

Enterprise AI has a trust issue. Interestingly, two incidents drove this point home. Back-to-back, they exposed a glaring weakness: the inability to vet external input. Copilot's mailbox exfiltration and LiteLLM's admin-key exposure are perfect examples. These incidents happened in quick succession. The results were alarming. dissect both, then provide a simple audit - just five checks - to help you assess your own systems.

How Copilot turned a harmless link into a mailbox exfiltration

A crafted microsoft. Still, com URL in your inbox? Copilot's Enterprise Search kicks in, no fanfare. This search tool works behind the scenes, using natural language processing and machine learning algorithms to understand the. Context of the URL and provide relevant search results, all while maintaining enterprise-grade security and compliance. Simple. The user gets accurate information, without lifting a finger.

Copilot reading email isn't the issue. Which means, microsoft designed this for productivity. But automatic handoff to a Bing backend via an SSRF tunnel crosses a line. That's the trust breaker. A single click is all an attacker needs. No extra permissions required. The victim's mailbox content gets sent to the attacker's domain. This happens because the request comes from Microsoft's infrastructure. Corporate firewalls usually let it pass. A data-leak vector is born. Simple clicks can have big consequences. Microsoft's own systems make this possible. To be fair, an attacker controls the domain. To be fair, traffic flows freely. To be fair, firewalls don't stop it. One click and your inbox is compromised.

I attempted to replicate the issue. On a brand new tenant, the results were immediate. Server-Side Request Forgery, or SSRF, was evident in the network logs within seconds, a clear indication of the vulnerability. That was fast.

LiteLLM’s admin‑key giveaway and why it matters beyond the code

A mistake happened. To be fair, last week, a pull request landed on LiteLLM's main branch, and somehow, a master API key got accidentally committed. That's a big deal. Someone messed up, and now the key is out there. The thing is, this kind of error can have serious consequences, especially for a project like LiteLLM that relies on secure API interactions. And yet, simple mistakes can be costly.

Libraries can be pretty fragile. They often wrap around multiple provider APIs with a single key, granting access to every downstream service. At the same time, this key is incredibly powerful. A leaked credential can cause chaos: spin up new instances, alter model weights, or drain usage quotas. Teams use LiteLLM in CI pipelines. That's a lot of power in one place. The exposure went undetected for days until a security researcher dug through the public Git history. A JSON blob held the token. No validation was performed on the key's origin. The code just assumed the caller was trusted. This is similar to the Copilot incident. Convenience can be a weakness. A component designed to make things easier became an entry point with no checks.

The solution was straightforward. Move the key to an environment variable. This way, the secret's no longer hard-coded. By adding a simple guard, the system refuses to start if it detects a hard-coded secret, which is a major security risk. Done. Now the key's protected.

Photo: cottonbro studio

💡 Expert Tip:

Final Thoughts

AI Tools

Source: https://venturebeat.com/security/copilot-searched-your-mailbox-litellm-handed-out-admin