This seems like a five alarm fire for HIPPA, is there something I’m missing?
It's HIPAA.
The HIPAA hippo certainly encourages this confusion
Copilot broke audit logs, but Microsoft won't tell customers
21–30 of 324 posts
Re: Copilot broke audit logs, but Microsoft won't tell customers
#22Re: Copilot broke audit logs, but Microsoft won't tell customers
#23Hard to count the number of things that can go wrong by relying directly on an LLM to manage audit/activity/etc. logs. What was their bug fix? Shadow prompts?
I'm very sceptical of using shadow prompts (or prompts of any kind) as an actual security/compliance control or enforcement mechanism. These things should be done using a deterministic system.
Re: Copilot broke audit logs, but Microsoft won't tell customers
#24Wait, copilot operates as some privileged user (that can bypass audit?), not as you (or better, you with some restrictions) That can’t be right, can it?
Sure sounds like, for Microsoft, an audit log is optional when it comes to cramming garbage AI integrations in places they don't belong.
Re: Copilot broke audit logs, but Microsoft won't tell customers
#25Re: Copilot broke audit logs, but Microsoft won't tell customers
#26I am so tired of Microsoft cramming Copilot into everything. Search at $dayjob is completely borked right now. It shows a page of results, but the immediately pops up some warning dialog you cannot dismiss that Copilot can’t access some file “” or something. Every VSCode update I feel like I have to turn off Copilot in some new way. And now apparently it’ll be added to Excel as well. Thankfully I don’t have to use an…
RE: VSCode copilot, you're not crazy, I'm seeing it too. And across multiple machines, even with settings sync enabled, I have to periodically go on each one and uninstall the copilot extension _again_. I'll notice the Add to chat... in the right click context menu and immediately know it got reinstalled somehow.
I'd switch to VSCodium but I use the WSL and SSH extensions :(
Re: Copilot broke audit logs, but Microsoft won't tell customers
#27Hard to count the number of things that can go wrong by relying directly on an LLM to manage audit/activity/etc. logs. What was their bug fix? Shadow prompts?
> Hard to count the number of things that can go wrong by relying directly on an LLM to manage audit/activity/etc. logs. Nothing in this post suggests that they're relying on the LLM itself to append to the audit logs. That would be a preposterous design. It seems far more likely the audit logs are being written by the scaffolding, not by the LLM, but they instrumented the wrong places. (I.e. emitting on a link or ma…
Heard, but since the content or its metadata must be surfaced by the LLM, what's the fix?
Re: Copilot broke audit logs, but Microsoft won't tell customers
#28Wait, copilot operates as some privileged user (that can bypass audit?), not as you (or better, you with some restrictions) That can’t be right, can it?
No, it accesses data with the users privilege.
Re: Copilot broke audit logs, but Microsoft won't tell customers
#29A better title would be: Microsoft Copilot isn't HIPAA compliant
A title like this will get it fixed faster.
Re: Copilot broke audit logs, but Microsoft won't tell customers
#30A better title would be: Microsoft Copilot isn't HIPAA compliant A title like this will get it fixed faster.
It already is fixed -- the complaint is that customers haven't been notified.