Microsoft confirmed that a Copilot security bug was allowing the AI assistant to read and summarize emails that were labeled as confidential. According to a report from Bleeping Computer, the bug bypassed Microsoft's data loss prevention policies, which are meant to protect sensitive information.
The bug was discovered in late January (tracked as CW1226324) and specifically affects Copilot Chat and the "work tab" feature. The bug let Copilot read and summarize emails in the sent and drafts folders, including messages that were explicitly labeled as confidential, which should have had restricted access.
Copilot Chat is Microsoft's version of Google Gemini or ChatGPT. It's meant to be content-aware and can interact with 365 apps like Word, Excel, Powerpoint and Outlook. The company began rolling it out to Microsoft 365 business customers in September 2025.
"Users' email messages with a confidential label applied are being incorrectly processed by Microsoft 365 Copilot chat," Microsoft confirmed.
The company said that an unspecified code error was responsible for the issue. A fix began rolling out in early February with Microsoft saying that it is continuing to monitor it. A final timeline for the rollout has not been revealed, nor has Microsoft stated how many organizations or individuals were affected.
That said, the issue has been tagged as "advisory," which usually means that the incident was limited in scope or impact.
"We identified and addressed an issue where Microsoft 365 Copilot Chat could return content from emails labeled confidential authored by a user and stored within their Draft and Sent Items in Outlook desktop. This did not provide anyone access to information they weren’t already authorized to see," a spokesperson told Bleeping Computer.
Follow Tom's Guide on Google News and add us as a preferred source to get our up-to-date news, analysis, and reviews in your feeds.
More from Tom's Guide
- Windows 11 is getting 3 new features in a major quality of life update — is Microsoft starting to pull back on AI slop?
- 'Concentrate on keeping it simple': Bill Gates wanted PCs to be straightforward, and Windows 11’s AI push is a betrayal
- Windows 10 users warned to upgrade now or risk a ‘degraded security state’ as Microsoft ends Secure Boot support
