Microsoft 365 Copilot had a one-click exploit that exposed inbox contents and stored passwords
01
Top story
Any staff member who clicked a crafted link inside their Microsoft 365 Copilot session this past year may have handed an attacker a copy of their inbox, including any passwords stored in email. Security researchers at Varonis found the vulnerability last autumn and reported it to Microsoft in November. The exploit required no login from the attacker and no confirmation from the user. Researchers got Copilot to reveal, through repeated questioning, an undocumented setting that fired commands automatically the moment someone clicked a link. Microsoft patched the issue on Tuesday. The fix requires no action from your team, but if nobody has yet audited which inboxes, shared drives, and documents your Copilot seats can read, this is a reasonable prompt to do that, and your IT administrator should know that Copilot maintains a memory store that survives password resets.
02
Quick hits
-
Tooling
Tailorbird builds 3D building models from geotagged social media photos
Tailorbird reconstructs floor plans, material lists, and unit-by-unit fixture counts for multifamily buildings by pulling geotagged photos posted to social media, then cross-referencing them with work order records and a basic site plan. Harbor Group, which manages 65,000 multifamily units, says the tool returns a full 3D model of a building to within an eighth of an inch in about three days. For architects advising owners on renovation scope or doing pre-acquisition work, this changes how much is knowable before construction documents begin. -
Practice
More than 1,200 contractors now use Beam AI to automate quantity takeoffs and estimating
Attentive.ai reports that Beam AI, its automated takeoff and bid estimating tool, has been adopted by over 1,200 contractors across the US and Canada. Contractors use it to pursue more bids without adding estimating staff. Architects negotiating scope and fee should expect faster bid turnarounds and, in some cases, more contractor interest in projects that might previously have been passed over. -
Practice
Gravis Robotics raises $200M from SoftBank for autonomous heavy equipment
SoftBank put $200M into the Zurich-based startup, which is building systems to run standard construction equipment without a human operator on site. Commercial deployment at scale is still some time away. At $200M in Series A funding, this is one of the largest single bets yet on autonomous construction machinery. -
Practice
Bedrock Robotics switches on fully autonomous excavators at live US infrastructure sites
Excavators at active projects for Sundt Construction and Zachry Construction are now digging without anyone in the cab, using Bedrock Robotics' retrofit sensor system. The technology spent a year under human supervision before this week's commercial launch and stops automatically when a person gets too close. Bedrock's co-founders came from Waymo.
03
New tools & releases
-
ToolingCalendly adds AI meeting notes, transcription, and follow-up email drafting
Calendly now joins meetings, records audio and video, transcribes them, and drafts follow-up emails. An AI assistant named Callie can set up meetings and pull context from past ones. Project managers and business development staff running a high volume of client calls can try it now.
Only one tool qualified today. Three of the four quick hits come from Construction Dive, which is more source concentration than usual; all three were specifically chosen for today's brief.