News: 0180823066

  ARM Give a man a fire and he's warm for a day, but set fire to him and he's warm for the rest of his life (Terry Pratchett, Jingo)

Microsoft Says Bug Causes Copilot To Summarize Confidential Emails

(Wednesday February 18, 2026 @05:40PM (msmash) from the oops-they-did-it-again dept.)


Microsoft says a Microsoft 365 Copilot bug has been causing the AI assistant to [1]summarize confidential emails since late January , bypassing data loss prevention (DLP) policies that organizations rely on to protect sensitive information. From a report:

> According to a service alert seen by BleepingComputer, this bug (tracked under CW1226324 and first detected on January 21) affects the Copilot "work tab" chat feature, which incorrectly reads and summarizes emails stored in users' Sent Items and Drafts folders, including messages that carry confidentiality labels explicitly designed to restrict access by automated tools.

>

> Copilot Chat (short for Microsoft 365 Copilot Chat) is the company's AI-powered, content-aware chat that lets users interact with AI agents. Microsoft began rolling out Copilot Chat to Word, Excel, PowerPoint, Outlook, and OneNote for paying Microsoft 365 business customers in September 2025.



[1] https://www.bleepingcomputer.com/news/microsoft/microsoft-says-bug-causes-copilot-to-summarize-confidential-emails/



I no longer trust Microsoft with MY data (Score:2)

by BrendaEM ( 871664 )

I have used Windows from 3.01, WFWG, 95, 2000, XP, ME, 7, 10, and now 11. I think that Microsoft hit its peak in 2000-XP. Now, I don't trust Microsoft with anything. I don't trust Microsoft Dropbox for anything more personal than cat photos. I switched to Linux Mint for my daily drivers, and use Windows with a carefully restricted data set. In the end, it's MY data, Microsoft, not yours.

Re: (Score:2)

by OrangeTide ( 124937 )

A Windows IT guy I used work with would tell me how Unix/Linux is insecure because Unix permissions are inferior compared to Access Control Lists (ACLs) everywhere. (Solaris and others have had support for them for decades). But then when he would ignore that LAN Manager clients were leaking weak hashes on the network, and that NTLM barely fixed the problem and 20 years later it's still being exploited for credential hijacks.

That people are only now realizing that Microsoft not only doesn't make secure or r

User hostile - prioritize sales over customers. (Score:5, Interesting)

by AleRunner ( 4556245 )

Once again a reminder of the risk of using Microsoft software (and many other, but not all, proprietary systems). Now it's an "unspecified code error", so I'll speculate a bit, but there's plenty of history here, so we can guess the truth.

There are ways for external software to interface with Exchange / Office 356. In fact, AI systems could happily be built to work directly with IMAP and other standardized interfaces. That's what Microsoft would expect external software companies to use and they would almost always mean that simple correct configuration of the mail server would stop that software being able to see the contents of these mails at all.

Instead of giving their own software the standard interfaces and allowing everyone who uses it to have control in the standard ways, Microsoft wants Copilot to have an advantage over the competition. They allow non standard, special interfaces for Copilot whilst the competition have to stick with the standards and suffer slower development. The user suffers from more complexity (two separate interfaces), more bugs and, like here, total loss of control and security. Microsoft sells out the user for more of their own sales.

bug (Score:4, Funny)

by bugs2squash ( 1132591 )

so they're saying the software is bugged ?

Re: (Score:2)

by UnknowingFool ( 672806 )

Well it is marginally better than saying, "oops those email summaries were only meant to be sent to the FBI. . ."

Well, they have to monetize all this AI somehow (Score:4, Funny)

by Megahard ( 1053072 )

"Here's a summary of all your confidential emails. It would be a shame if this all got out somehow."

Feature (Score:2)

by Archangel Michael ( 180766 )

It is a feature, not a bug!

But hey, lets claim incompetence and not malice even though they are indistinguishable at this point.

You can't do this with confidential data (Score:4, Insightful)

by Anonymous Coward

You can't run badly tested software relying on alpha level technology (AI) and have any reasonable expectations it's going to work properly. Why are people doing this? There's a reason AI is being banned in any workplace with NDAs, trade secrets, and customer data.

All the CEOs and MBAs out there mandating that their employees use AI daily as much as possible, despite only being alpha testing level, are idiots.

Re: (Score:2)

by Fly Swatter ( 30498 )

It's not the people, it's the companies. They invested billions (trillions?) into data center expansion and development, and discovered few people willingly turn on their heavily indebtedness AI features - so instead of reading the wall they made it a default feature that most never asked for. Now they can claim billions of users of AI when in fact it's just a feature that runs whenever you interact with the UI.

Now AI corps can say 'Look, we have all these users to justify our wreckless hoarding of compu

Remember ... (Score:2)

by King_TJ ( 85913 )

This comes from the company who JUST suggested AI is ready to take away pretty much ALL white collar jobs within the next 18 months.

So this means that DLP is junk? (Score:2)

by ebunga ( 95613 )

Sounds like this means that DLP isn't integrated at the lowest levels but is just a bolt-on thing that's advisory at best. Makes me wonder if this also means cross-tennant protections aren't as robust as one would assume.

Oops, sorry guys. (Score:2)

by nightflameauto ( 6607976 )

The AI sucking down all your confidential data accidentally let you know it's been scarfing down all your data. We'll try to fix it so it keeps your confidential emails from returning a summary to you while it continues to scarf them down going forward. Sorry 'bout the mix-up.

Serious question (Score:1)

by kenh ( 9056 )

How is this different from Outlook previewing the first few lines of an email?

Does outlook send emails off to a remote server to generate the summary or is it locally generated?

Can anyone other than the intended recipient of the email see the AI-generated summary of confidential emails?

IF, as I suspect but don't know, the local PC generated summaries are only viewable by the proper, logged in recipient of the confidential email, what's the problem?

Now, if confidential emails are flying out to off-site MS AI

Never been Confidential (Score:2)

by HnT ( 306652 )

If they could break the confidentially THIS easily and amateurishly, those emails were never actually confidential in the first place.

I am wondering in how much legal trouble that puts M$, especially over in Bxl.

FBI, NSA, CIA (Score:2)

by labnet ( 457441 )

The three letter agencies are very pleased.

Huge time saver!

wait, what? the Label is THE protection? (Score:2)

by Jayhawk0123 ( 8440955 )

so the label of confidential is THE protection mechanism... not actually blocking access, but relying on the external tool to READ and ADHERE to the label?

This is akin to writing a book with classified info, putting classified on the page and trusting who ever reads the book skips the pages that say confidential.

Q: What's a WASP's idea of open-mindedness?
A: Dating a Canadian.