Microsoft Copilot Bug Exposed Confidential Emails in Outlook
A software error in Microsoft 365 Copilot Chat allowed the artificial intelligence assistant to summarize confidential emails, bypassing security protocols designed to protect sensitive information. The issue specifically affected the “work tab” within Copilot Chat, a feature integrated into applications like Outlook, Word, and Excel. The bug enabled the AI to read and process messages stored in users’ Sent Items and Drafts folders even when those emails carried strict confidentiality labels.
The glitch circumvented Data Loss Prevention (DLP) policies that organizations rely on to restrict automated access to classified data. Microsoft confirmed the problem after internal tracking identified the code issue as CW1226324. The company stated that the error first appeared in late January 2026. The technical flaw caused Copilot to ignore the sensitivity tags that should have prevented it from accessing or summarizing the protected content.
Microsoft clarified that the exposure was limited to the individual user who authored the emails. The bug did not grant unauthorized access to other employees or external parties, meaning users could only see summaries of their own confidential drafts and sent messages. The technology giant attributed the problem to a code error rather than a malicious intrusion. While the scope of the impact remains unspecified, the company noted that data leakage to third parties did not occur.
A fix was developed and deployment began in early February. Microsoft has since rolled out a configuration update to enterprise customers worldwide to resolve the vulnerability. The company is currently monitoring the situation and contacting affected organizations to verify that the patch is functioning correctly. Security experts warn that such vulnerabilities may become more common as companies race to integrate complex generative AI features into enterprise software.
