Editorial illustration for Microsoft Copilot ignored sensitivity labels twice; DLP missed both
Microsoft Copilot Bypasses Email Privacy Safeguards
Microsoft Copilot ignored sensitivity labels twice; DLP missed both
The security stack reported all-clear, because it never saw the layer where the violation occurred. That is the paradox at the heart of two separate failures in Microsoft Copilot, spaced eight months apart, where sensitivity labels were simply ignored and data loss prevention tools never stirred. The first, tracked as CW1226324, was a code-path error: drafts and sent items slipped into Copilot’s retrieval set as though the labels and DLP rules did not exist.
The second, dubbed EchoLeak by researchers at Aim Security, was more insidious. A carefully crafted email, dressed as ordinary business correspondence, commandeered Copilot’s retrieval-augmented generation pipeline to exfiltrate internal data to an attacker-controlled server. Aim Security called it a fundamental design flaw: agents process trusted and untrusted data in the same thought process, structurally vulnerable to manipulation.
Two blind spots in one system, and nothing in the stack saw it coming.
The security stack reported all-clear because it never saw the layer where the violation occurred. The CW1226324 bug worked because a code-path error allowed messages in Sent Items and Drafts to enter Copilot's retrieval set despite sensitivity labels and DLP rules that should have blocked them, according to Microsoft's advisory. EchoLeak worked because Aim Security's researchers proved that a malicious email, phrased to look like ordinary business correspondence, could manipulate Copilot's retrieval-augmented generation pipeline into accessing and transmitting internal data to an attacker-controlled server. Aim Security's researchers characterized it as a fundamental design flaw: agents process trusted and untrusted data in the same thought process, making them structurally vulnerable to manipulation.
The security stack saw nothing because it was never designed to look at the seams between layers. Two incidents, eight months apart, and the same blind spot: tools trusted the data they touched without ever questioning whether that trust was earned. The bug is a symptom, but EchoLeak is the diagnosis.
When an agent cannot distinguish a legitimate email from a weaponized one, the architecture itself is the vulnerability. Patching the code path fixes the symptom. Rethinking the agent’s cognitive pipeline, forcing a firewall between trusted and untrusted inputs, is the only treatment that matters.
Until that separation is hard-coded, every sensitivity label and every DLP rule is just a painted-over crack in the foundation.
Related Reading
Browse all Microsoft news →
AI Tools & Apps Claude gains shared context in Excel, PowerPoint; Microsoft adds Copilot Cowork
AI Tools & Apps Windows Copilot AI unable to pinpoint image source in user test
AI Tools & Apps LG's recent webOS update adds Microsoft Copilot app, now removable
Related Topic Nadella: AI success needs intense usage, Cloud hits USD 54.5B, Azure up 40%
Business & Startups
Related Topic OpenAI secures USD 110 billion from Amazon, Nvidia, SoftBank; Microsoft tie strong
Business & Startups
From Archives AWS blames staff after Kiro AI coding assistant triggers 13‑hour outage
From Archives Hacker Exploits Cline AI Coding Agent Vulnerability Highlighted by Researcher
From Archives Microsoft expands AI investments in Singapore, partners with AISG on health
Business & Startups
From Archives GitHub adds Claude and Codex agents to Copilot’s Agent HQ platform
LLMs & Generative AI
Common Questions Answered
How did the Microsoft 365 Copilot bug bypass data loss prevention (DLP) policies for confidential emails?
The bug (tracked as CW1226324) allowed Copilot to incorrectly process emails with confidential labels in Sent Items and Drafts folders, despite existing DLP policies. Microsoft confirmed that a code issue enabled the AI to summarize sensitive emails by circumventing the normal sensitivity label enforcement mechanisms.
What specific folders were affected by the Microsoft 365 Copilot email summarization bug?
The bug specifically impacted emails in users' Sent Items and Drafts folders, allowing Copilot to access and summarize messages that were explicitly labeled as confidential. This meant that even emails not yet sent or recently sent could be processed by the AI assistant, contrary to established data protection policies.
When did Microsoft become aware of the Copilot email summarization vulnerability?
Microsoft first identified the issue on January 21, 2026, and began rolling out a fix in early February. The company did not disclose the full extent of affected customers, but confirmed the bug in a service advisory that acknowledged the incorrect processing of confidential-labeled emails.
What are the potential compliance risks of this Microsoft 365 Copilot bug?
The bug creates significant compliance risks for organizations, especially those in regulated industries subject to frameworks like GDPR or HIPAA. It represents an 'exfiltration-by-prompt' risk where sensitive information could be inadvertently exposed through AI summarization, potentially triggering reporting obligations and compromising data protection measures.
Further Reading
- Microsoft says bug causes Copilot to summarize confidential emails — BleepingComputer
- Microsoft says Office bug exposed customers' confidential emails to Copilot AI — TechCrunch
- Microsoft confirms Copilot bug let its AI read sensitive and confidential emails — Tom's Guide
- Microsoft Copilot Bug Raises CX Email Security Concerns — CX Today
