Enterprise "Microsoft 365 Copilot" Summarizes Confidential Email Content While Ignoring DLP Settings - Patch Being Deployed - ITmedia NEWS

Microsoft acknowledged that Copilot has been summarizing customers' confidential emails for several weeks. Bleeping Computer reported this issue on February 18 (local time). The problem is being tracked internally at Microsoft as "CW1226324." It is described as a flaw where AI bypasses data loss prevention (DLP) policies and confidential labels that companies set to protect sensitive information. According to Microsoft's advisory, the cause is due to a "code defect (bug)." Despite "confidential" labels being explicitly set to exclude emails from automatic processing, confidential emails stored in the user's "Sent Items" and "Drafts" folders were improperly indexed and became targets for summarization by Copilot. This unusual behavior was first detected around January 21, and Microsoft began deploying fixes on the server side in early February. The company is still monitoring the progress of the fixes and contacting some affected customers to verify the effectiveness of the patches. It is noted that free versions and personal Copilot accounts are not affected by this issue. At this stage, Microsoft has not disclosed the total number of affected customers, nor has it provided detailed audit logs.