When Copilot searches where he shouldn't

Oops. Microsoft confirmed that Copilot had been summarizing confidential emails in Microsoft 365 since the end of January, bypassing the data loss prevention (DLP) policies used by businesses and organizations to protect their sensitive information. The bug, detected on January 21st, specifically concerns the "work" tab of the Copilot chat function within the office suite.

Copilot Mistake

This allowed Copilot to access and summarize emails stored in users' "drafts" and "sent" folders… including messages explicitly labeled as confidential, which are supposed to prevent access to this type of AI tool. « Emails of users with a privacy label applied are being processed incorrectly by Microsoft 365 Copilot chat », the publisher confirmed.

Microsoft confirmed that a "code error" was the cause of the bug, and that a fix is being rolled out since the beginning of February. However, the company does not provide a schedule for the complete resolution of the issue, nor does it indicate the number of users or organizations affected. The extent of the impact may change during the investigation period.

Copilot Chat is part of the new and numerous AI tools that Microsoft integrates into its office suite across all its software and services. The tool was thus introduced in September 2025 into Word, PowerPoint, Excel, Outlook, and OneNote within the Microsoft 365 suite for enterprise customers.

Microsoft did not take long to respond, which is good news. But the mistake shows that it is still very difficult to place blind trust in generative AI as long as basic security issues are not resolved.

👉🏻 Follow real-time tech news: add 01net to your Google sources, and subscribe to our WhatsApp channel.

Source : BleepingComputer