Microsoft 365 Copilot Bug Summarizes Confidential Emails Despite DLP Policies

Microsoft has confirmed that a bug in Microsoft 365 Copilot, specifically in the ‘work tab’ chat feature, has been summarizing confidential emails since January 21, 2025. This issue allows the AI assistant to read and summarize emails that have confidentiality labels, which are meant to restrict access by automated tools. The bug was first detected in late January and has been tracked under the identifier CW1226324.

The problem arises from a code error that permits items in the Sent Items and Drafts folders to be accessed by Copilot, despite the presence of DLP policies. Microsoft began rolling out a fix in early February and is actively monitoring the situation, reaching out to affected users to verify the effectiveness of the solution.

While Microsoft has not provided a specific timeline for full remediation, the ongoing incident has been classified as an advisory, indicating limited scope or impact. However, the lack of details regarding the number of affected users or organizations raises concerns about the potential exposure of sensitive information.

Implications for Users and Organizations

This incident highlights the risks associated with AI tools in handling sensitive data. Organizations relying on Microsoft 365 Copilot must be vigilant about the capabilities and limitations of AI features, especially when dealing with confidential communications.

Users should regularly review their DLP policies and ensure that confidentiality labels are correctly applied to sensitive emails. Additionally, organizations may want to monitor the effectiveness of the fix being rolled out by Microsoft and assess any changes in their data protection strategies.

As AI technology continues to evolve, the potential for similar issues to arise remains. Organizations should stay informed about updates from Microsoft and be proactive in addressing any vulnerabilities that may impact their data security.