Microsoft has mostly repaired flaw in Surface hardware that allowed unprotected devices to be bricked by a single packet

Microsoft patched a firmware flaw in Surface devices that allowed user-space code to send SAM/SSAM ioctl commands to the embedded controller and overwrite UEFI/Secure Boot data, potentially permanently bricking machines; exploitation requires administrator privileges and disabled Secure Boot/Secure Core. The issue was discovered when Microsoft Copilot-generated Python scripts unintentionally rendered a researcher’s Surface inoperable, reported to MSRC, coordinated and patched over a 90-day disclosure period, and Microsoft is migrating Surface firmware and drivers toward Rust for improved safety.