Tighten AI Connector Controls and Verify Third-Party Data Handling

What happened

Varonis researchers manipulated Microsoft Copilot Personal into revealing how to hack itself and exfiltrate data using prompt‑injection and a discovered autorun parameter. The exploit can trigger OAuth connectors (Gmail, Drive, Calendar) and pull chats or files; Microsoft planned a patch and formal CVE disclosure. Operationally, enterprise customers using persistent memory or external connectors should expect configuration guidance and patches and must watch vendor mitigation timelines

Why the category manager should care

Treat deployed AI assistants and their connectors as high‑risk integrations that require inventory, explicit disable controls, patch commitments, and connector‑specific SLAs

Key facts

• Vulnerability disclosed by Varonis Threat Labs and named 'CoSnitch'
• Exploit uses an 'autorun=1' prompt parameter delivered via crafted URL to trigger connector a
• Microsoft planned to issue a patch and formally identify a CVE

What happened

An Australian hotel chain reported unauthorized access to a third‑party database operator that exposed guest personal records, including names, contact details and some dates of birth for records predating a cutoff. The vendor‑vector breach was identified in mid‑August and impacts records across many properties. Buyers should demand deletion attestations and logs from processors and expect negotiation over indemnity and notification scope

Why the category manager should care

Require processors to produce deletion attestations, access logs, and clear breach notification and remediation responsibilities in contract terms

Key facts

• Incident identified in mid‑August and attributed to a third‑party database operator
• Exposed records include guest names, contact details and some dates of birth
• Affected records predate the supplier's specified retention cutoff

What happened

Raspberry Pi announced a programming jig that integrates the provisioning host and module interface to program Compute Module 5 (CM5) boards one at a time. A typical install cycle is around 90 seconds and the unit removes the need for a separate IO board, which simplifies batch provisioning but limits per‑unit throughput. Procurement should weigh the jig’s CAPEX and support needs against outsourced programming options and supplier tooling lock‑in

Why the category manager should care

Factor the jig into provisioning strategy: it reduces manual steps but shifts throughput, support and CAPEX considerations to buyers

Key facts

• Single‑head programming jig provisions one CM5 at a time
• Typical installation cycle reported at about 90 seconds per module
• Integrates controller and pogo‑pin interface to remove separate IO board requirement

What happened

The Xen Project created a Safety Committee to pursue formal safety standards compliance (e.g., IEC‑61508) so the hypervisor can be used in embedded, automotive and robotic workloads. The effort aims to produce shared engineering evidence to accelerate certification and reduce duplicated work by vendors. Buyers should ask virtualization suppliers for certification plans and test artifacts when evaluating safety‑sensitive virtualization components

Why the category manager should care

Ask virtualization suppliers for safety certification roadmaps and concrete evidence as part of technical evaluation for embedded programs

Key facts

• Creation of a Xen Project Safety Committee focused on formal safety work
• Aim to maintain shared engineering evidence to accelerate certification programs
• Recent code additions include CPU isolation support improvements for safer workload separation