Microsoft Fixes Copilot Bug That Summarized Confidential Emails Despite DLP Controls
Summary
Microsoft says a code error let Microsoft 365 Copilot summarize labeled emails in users’ Sent Items and Drafts despite DLP policies. A fix rollout began in early February; the impact scope and full remediation timeline remain unknown.
Key points
- The issue, tracked as CW1226324 and first detected January 21, affects Microsoft 365 Copilot’s “work tab” chat.
- Copilot incorrectly processed and summarized emails in users’ Sent Items and Drafts, including messages with confidentiality labels.
- Microsoft said the error bypassed configured data loss prevention policies.
- Microsoft attributed the issue to a code error and began rolling out a fix in early February.
- Microsoft is monitoring the deployment and contacting some affected users, but has not disclosed the impact scope or a final remediation timeline.
Article Details
- Event Type
- Microsoft 365 Copilot Chat bug causing confidential email processing
- Impact
- Copilot Chat incorrectly read and summarized emails in users’ Sent Items and Drafts, including messages with confidentiality labels, bypassing configured data loss prevention controls. Microsoft said the issue affected an unspecified number of users and organizations.
Vendors
Products
Copilot ChatCopilot Chat has been reading and summarizing emails stored in Sent Items and Drafts folders.Microsoft 365 CopilotMicrosoft says a bug in the Microsoft 365 Copilot “work tab” chat has been summarizing confidential emails from users’ Sent Items and Drafts since late January, bypassing sensitivity labels and configured data loss