Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Copilot broke audit logs, but Microsoft won't tell customers

pistachioapp.com

Post reply on HN
Print view View original

231–240 of 324 posts

Re: Copilot broke audit logs, but Microsoft won't tell customers

#231

Post by DannyBee »

malfist wrote: post #212
DannyBee wrote: post #211

Earlier quoted context omitted.

"would be required on a per user basis or track the access rights along with the content, which is infeasible and does not scale" Citation needed. Most enterprise (homegrown or not) search engine products have to do this, and have been able to do it effectively at scale, for decades at this point. This is a very well known and well-solved problem, and the solutions are very directly applicable to the products you lis…

If you're stringing together a bunch of MCPs you probably also have to string together a bunch of authorization mechanisms. Try having your search engine confirm live each persons access to each possible row. It's absolutely a hard problem and it isn't well solved

Yes, if you try to string together 30 systems with no controls and implement controls at the end it can be hard and slow - "this method i designed to not work doesn't work" is not very surprising.

But the reply i made was to " This means Vector databases, Search Indexes or fancy "AI Search Databases" would be required on a per user basis or track the access rights along with the content, which is infeasible and does not scale."

IE information retrieval.

Access control in information retrieval is a very well studied.

Making search engines, etc that effectively confirm user access to each possible record is feasible and common (They don't do it exactly this way but the result is the same), and scalable.

Hell, we even known how to do private information retrieval with access control in scalable ways.

PIR = the server does not know what the query was, or the result was, but still retrieves the result.

So we know how to make it so not only does the server does not know what was queried or retrieved by a user, but each querying user still only can access records they are allowed to.

Overhead of this, which is much harder than non-private information retrieval with access control, is only 2-3x in computation. See, e.g., https://dspace.mit.edu/handle/1721.1/151392 for one example of such a system. There are others.

So even if your 2ms retrieval latency was all CPU and 0 I/O, it would only become 4-6ms do to this.

If you remove the PIR part, as i said, it's much easier, and the overhead is much much less, since it doesn't involve tons and tons of computationally expensive encryption primitives (though some schemes still involve some).

Re: Copilot broke audit logs, but Microsoft won't tell customers

#232

Post by [deleted] »

scott_w wrote: post #230
pc86 wrote: post #228

Earlier quoted context omitted.

> I'm making an assumption on how these AI Agents work, I could be wrong. I don't understand the desire - borderline need - of folks on HN to just make stuff up. That is likely why you're being downvoted. I know we all love to do stuff "frOM fIRsT PRiNcIPlEs" around here but "let me just imagine how I think AI agents work then pass that off as truth" is taking it a bit far IMO. This is the human equivalent of an AI h…

And yet if we didn't do this, HN would be almost completely silent because 99% of commenters have a clue what they're talking about most of the time and nobody would ever have a chance to learn.

[deleted]

Re: Copilot broke audit logs, but Microsoft won't tell customers

#233

Post by krapp »

pc86 wrote: post #228
scott_w wrote: post #223

Earlier quoted context omitted.

> I don't understand why you think tracking user access rights would be infeasible and would not scale. Allow me to try to inject my understanding of how these agents work vs regular applications. A regular SaaS will have an API endpoint that has permissions attached. Before the endpoint processes anything, the user making the request has their permissions checked against the endpoint itself. Once this request succee…

> I'm making an assumption on how these AI Agents work, I could be wrong. I don't understand the desire - borderline need - of folks on HN to just make stuff up. That is likely why you're being downvoted. I know we all love to do stuff "frOM fIRsT PRiNcIPlEs" around here but "let me just imagine how I think AI agents work then pass that off as truth" is taking it a bit far IMO. This is the human equivalent of an AI h…

>I don't understand the desire - borderline need - of folks on HN to just make stuff up.

Hacker News is addictive. This forum is designed to reward engagement with imaginary internet points and that operant conditioning works just as well here as everywhere else.

Re: Copilot broke audit logs, but Microsoft won't tell customers

#234

Post by Lu2025 »

jacquesm wrote: post #173
planb wrote: post #171

Earlier quoted context omitted.

That would surely be a possible way, but I don't want to block anything, I just want reasonable expectations and a basic understanding of the problem on all sides.

If you start CC'ing legal or compliance on such issues you may very well need a planb.

This is correct. People on top are very much ego driven and don't forgive those who say no to them or make them look bad.

Re: Copilot broke audit logs, but Microsoft won't tell customers

#236

Post by Lu2025 »

lupusreal wrote: post #166
carschno wrote: post #161

Earlier quoted context omitted.

> I am having a really hard time communicating this problem to executives When you hit such a wall, you might not be failing to communicate, nor them failing to understand. In reality, said executives have probably chosen to ignore the issue, but also don't want to take accountability for the eventual leaks. So "not understanding" is the easiest way to blame the engineers later.

It doesn't even need to be blaming the engineers in this case, they can blame "the AI" and most people will accept that and let whatever incident happened slide. If somebody questions the wisdom of putting AI in such a position, they can be dismissed as not appreciating new technology (even though their concern is valid.)

Yep. AI is wonderful for IP laundering and accountability laundering (is this even a term? It is now!)

Re: Copilot broke audit logs, but Microsoft won't tell customers

#237

Post by andrewaylett »

Drakim wrote: post #194
falcor84 wrote: post #192

Earlier quoted context omitted.

I'm unclear on what the "flaw" is - isn't this precisely the "feature" that search engines provide to both sides and that site owners put a ton of SEO effort into optimizing?

If you have public documents, you can obviously let a public search engine index them and show previews. All is good. If you have private documents, you can't let a public search engine index and show previews of those private documents. Even if you add an authentication wall for normal users if they try to open the document directly. They could still see part of the document in google's preview. My explanation sound…

You say that, but it happens — "Experts Exchange", for example, certainly used to try to hide the answers from users who hadn't paid while encouraging search engines to index them.

Re: Copilot broke audit logs, but Microsoft won't tell customers

#238

Post by flir »

lupusreal wrote: post #166
carschno wrote: post #161

Earlier quoted context omitted.

> I am having a really hard time communicating this problem to executives When you hit such a wall, you might not be failing to communicate, nor them failing to understand. In reality, said executives have probably chosen to ignore the issue, but also don't want to take accountability for the eventual leaks. So "not understanding" is the easiest way to blame the engineers later.

It doesn't even need to be blaming the engineers in this case, they can blame "the AI" and most people will accept that and let whatever incident happened slide. If somebody questions the wisdom of putting AI in such a position, they can be dismissed as not appreciating new technology (even though their concern is valid.)

"the AI did it" is going to be the new "somebody hacked my facebook account"

I wish I had a way of ensuring culpability remains with the human who published the text, regardless of who/what authored it.

Re: Copilot broke audit logs, but Microsoft won't tell customers

#239

Post by lmeyerov »

awirth wrote: post #229
planb wrote: post #158

I am assigned to develop a company internal chatbot that accesses confidential documents and I am having a really hard time communicating this problem to executives: As long as not ALL the data the agent hat access too is checked against the rights of the current user placing the request, there WILL be ways to leak data. This means Vector databases, Search Indexes or fancy "AI Search Databases" would be required on a…

What you're describing is a specific case of a confused deputy problem: https://en.wikipedia.org/wiki/Confused_deputy_problem This is captured in the OWASP LLM Top 10 "LLM02:2025 Sensitive Information Disclosure" risk: https://genai.owasp.org/llmrisk/llm022025-sensitive-informat... although in some cases the "LLM06:2025 Excessive Agency" risk is also applicable. I believe that some enterprise RAG solutions create a p…

Exactly. We often end up doing 'direct' retrieval (ex: DB query gen) to skip the time suck , costs , and insecurity of vector RAG, and per user indexing for the same. Agentic reasoning loops means this can be better quality and faster anyways.

Sometimes hard to avoid though, like our firehose analyzers :(

Post reply on HN