Case copilot-confidential-emails-bugModel & data leakUnited States
Microsoft 365 Copilot bug summarises confidential emails despite DLP policies
Microsoft confirmed (CW1226324) that a code error let Copilot Chat's work tab read and summarise Drafts and Sent Items emails carrying labels such as Confidential despite DLP policies. A fix rolled out in February 2026.
MediumAttack on AIStatus: PatchedVerified case file
Open in the interactive mapCite this case
- Reported
- Jan 21, 2026
- Location
- United States
- Target
- Microsoft 365 Copilot Chat customers
- Severity
- Medium
- Triggered by
- Microsoft (software defect)
- Actor type
- Accidental / misconfiguration
- Reported loss
- None reported
- CVE
- None
What happened
Microsoft confirmed (CW1226324) that a code error let Copilot Chat's work tab read and summarise Drafts and Sent Items emails carrying labels such as Confidential despite DLP policies. A fix rolled out in February 2026.
Impact: Unknown number of tenants; confidential content exposed to Copilot summaries
Who triggered it
Actor: Microsoft (software defect)
Attribution: Acknowledged by Microsoft in a service alert
Motive: None (bug)
How it happened
Attack vector: Copilot Chat processing labelled mail outside intended scope
Root cause: Code error in Copilot's handling of sensitivity labels and DLP enforcement
Timeline
- Issue identified
- Fix rollout begins
Response
Microsoft deployed a fix and tracked the issue in the admin center
Current status: Patched
Sources (open in a new tab)
- BleepingComputer bleepingcomputer.com
- Petri petri.com
- TechRadar techradar.com
Cite this case
Microsoft 365 Copilot bug summarises confidential emails despite DLP policies. AI Threat Watch, case copilot-confidential-emails-bug, Jan 21, 2026. https://aithreat.io/cases/copilot-confidential-emails-bug/
Permanent link: https://aithreat.io/cases/copilot-confidential-emails-bug/