Microsoft has publicly acknowledged a significant software issue in its Microsoft 365 Copilot Chat feature that, under specific conditions, has improperly processed and summarized confidential emails, potentially bypassing organizations’ data protection controls.
What Happened?
In late January 2026, Microsoft detected that a code error in the Copilot integration for Microsoft 365 allowed the generative AI chatbot to read and summarize emails marked as confidential, even when those emails were protected by Data Loss Prevention (DLP) policies. Normally, sensitivity labels and DLP settings are designed to prevent automated tools from accessing or analyzing sensitive content — but this bug caused those protections to be ignored in certain folders.
Specifically, messages stored in the Sent Items and Drafts folders were being picked up and processed by Copilot Chat regardless of their sensitivity labels. This included emails with confidentiality tags meant to prevent access by both humans and automated scanning tools.
Where It Occurred
The issue affected the Copilot “Work tab” Chat — part of Microsoft 365 Copilot that allows users to query their workspace account for summaries, analysis, and responses using AI. Copilot Chat is surfaceable across services like Outlook, Word, Excel, and PowerPoint, but the email-specific issue manifested primarily in the chat feature when reflecting on mail stored in user mailboxes.
Microsoft classifies the incident as a service advisory — technically indicating that the bug operated within the expected support framework but still posed a notable lapse in compliance behavior.
Technical Root Cause
According to the service advisory tracked as CW1226324, the root cause was a code defect in Copilot’s handling of DLP rules. While Microsoft has not published a detailed post-incident report as of this writing, the core problem was that Copilot’s processing logic did not correctly respect sensitivity labels for emails in certain mailbox locations. This caused confidential content to be included in the AI’s context and summarization operations despite explicit protection policies.
In normal operation, sensitivity labels and DLP policies should function as follows:
- Sensitivity Labels (e.g., Confidential): Tag content with metadata that defines how it can be accessed or shared.
- DLP Policies: Enforce rules that block or restrict actions (including automated analysis) on sensitive content.
In this incident, the DLP policy was configured correctly, but Copilot ignored or circumvented it due to the code error.
Scope and Impact
Microsoft has not disclosed exact numbers of affected tenants or users, nor has it indicated whether any third parties observed the content outside of expected user queries. However, the advisory noted that the bug was active for weeks before being recognized and that a fix was rolled out starting in early February 2026. Microsoft continues to monitor environments as the deployment of fixes completes.
The company has also reached out to a subset of affected enterprise customers to verify remediation and ensure that the bug no longer leads to unintended email summaries.
Why This Matters (Technical Implications)
From a security architecture and corporate compliance standpoint, this issue reveals several risks inherent to integrating generative AI into enterprise platforms:
- Trust Boundary Erosion: Features like Copilot operate with deep access to user data for productivity reasons. But when safeguards like DLP fail, the AI becomes another pathway to access sensitive content.
- Context Explosion in AI Agents: Copilot uses contextual retrieval mechanisms to pull in data relevant to user queries. Without strict isolation based on policy enforcement, sensitive data may unintentionally enter that context.
- SaaS Trust Model: As one expert noted, any SaaS environment assumes provider compliance with policies — and bugs like this demonstrate the potential fragility of that trust.
Technical and Administrative Recommendations
In light of this incident, organizations using Copilot should consider the following:
- Audit DLP and Sensitivity Configurations
Ensure that all policies are correctly configured at both the Microsoft Purview and Exchange Online levels. - Monitor Microsoft Service Health Alerts
Track advisories like CW1226324 to catch future issues early. - Limit Copilot Access Where Necessary
For especially sensitive environments, temporarily restrict Copilot Chat access until full compliance behavior is verified. - Review Tenant-Wide Context-Sensitive Features
Understand where generative AI is enabled across Microsoft 365 services and whether configuration best practices are being applied.
In summary, while Microsoft has moved to fix the bug that caused sensitive emails to be erroneously processed by Copilot, the episode highlights important engineering and governance challenges when integrating powerful AI tools into enterprise ecosystems. The interaction between policy enforcement and AI context processing must be robustly tested to prevent similar compliance lapses in the future.
