Microsoft has confirmed and patched a flaw in Microsoft 365 Copilot Chat that allowed the AI assistant to read and summarize certain confidential emails despite existing protection rules. The issue, which persisted for several weeks, is now resolved, but it is likely to intensify scrutiny around how AI tools interact with sensitive enterprise data.
The problem affected the Copilot “work tab” chat experience inside Microsoft 365 applications such as Outlook. According to Microsoft, a code defect identified internally as CW1226324 caused Copilot to process emails in Sent Items and Drafts folders even when those messages carried sensitivity labels and Data Loss Prevention (DLP) policies meant to block automated access.
In practical terms, the core email security system continued to apply labels correctly. However, Copilot’s summarization pipeline failed to respect those controls and could pull protected content into AI-generated responses when users asked work-related questions.
Microsoft noted that standard inbox messages were not directly impacted by this specific bug. Still, because email threads often appear in Sent or Draft folders, some sensitive incoming content may have surfaced indirectly in Copilot summaries.
Microsoft detected the issue on January 21, 2026, and began investigating through internal service health channels. The exposure window appears to have run from late January until the company rolled out fixes in early to mid-February.
During that period, affected users could receive AI summaries that included material marked as confidential, even though the underlying protection policies were configured correctly.
In public advisories and statements to the media, Microsoft acknowledged the defect and moved to deploy a configuration and code update globally.
The company said the patch restores the intended behavior so that emails protected by sensitivity labels are excluded from Copilot processing. Microsoft also emphasized an important limitation of the incident: the summaries were only shown to users who already had permission to access the mailbox in question.
In other words, the bug did not open mailboxes to unauthorized users. However, Microsoft has not disclosed how many organizations were affected, describing the impact only as a “small percentage” of customers using Copilot alongside confidential labeling.
Even with the limited exposure scope, the incident has raised concerns among cybersecurity and governance specialists. The core issue is not traditional access control failure but something subtler: an AI layer bypassing safeguards that organizations assumed were being enforced consistently.
Key concerns highlighted by analysts include:
For regulated industries, where sensitivity labels and DLP controls are central compliance mechanisms, this type of mismatch can undermine confidence in AI-assisted workflows.
The Copilot incident arrives amid growing caution around generative AI in workplace environments. Earlier concerns had already surfaced in government settings. The European Parliament’s IT department, for example, previously disabled built-in AI features in its Microsoft 365 environment over worries that confidential correspondence could be exposed through cloud-based AI processing.
This latest bug is likely to reinforce a more cautious posture among large enterprises evaluating AI assistants.
Security professionals increasingly argue that organizations should treat tools like Copilot as active data processors, not just passive productivity features. That distinction affects how DLP policies, audit logs, and governance controls should be designed.
The episode serves as a reminder that AI integrations introduce a new layer of complexity on top of existing security models. Even when traditional protections appear correctly configured, implementation gaps inside AI pipelines can create unexpected visibility into sensitive data.
Governance experts now recommend that organizations adopting Copilot-style tools should:
Microsoft has moved quickly to fix the defect, and there is no indication of unauthorized external access. Still, the incident highlights a broader reality: as AI assistants become embedded in productivity software, they also become part of the enterprise data surface area.
For many organizations, the question is no longer whether to deploy AI copilots, but how to ensure those systems consistently respect the same guardrails that govern traditional data access.
The recent Copilot bug suggests that alignment is still a work in progress.
WhatsApp is preparing to allow third-party artificial intelligence cha...
BrandCrowd built its name as a go-to logo tool for small business...
There is a specific kind of disappointment that comes from opening a b...
AI companion apps have moved well beyond novelty status. What started...
Let’s start with an uncomfortable truth. Most people want their photos...
The U.S. Commerce Department is considering a new set of export contro...
Discussion