Microsoft says it has fixed an Office bug that caused Microsoft 365 Copilot Chat to incorrectly process confidential-labeled emails, allowing the AI to generate summaries of messages that should have been protected. The issue persisted for weeks, and in some cases could affect emails even when organizations had policies intended to prevent sensitive data from being used by Copilot.
The problem was first surfaced publicly by BleepingComputer, and Microsoft later acknowledged it in an admin advisory tracked as CW1226324. According to Microsoft’s notice, draft and sent emails carrying a “confidential” label were being “incorrectly processed” by Copilot Chat—meaning users could see AI summaries of content their organizations expected to be excluded.
👉 Browse Microsoft Purview & DLP guides on Amazon
(Affiliate link: using this link may earn a commission.)
What the bug did—and why it matters
Copilot Chat is the AI chat experience available to paying Microsoft 365 customers across Office apps, designed to help users summarize and work with content in their environment. But with this bug, organizations that relied on confidential/sensitivity labels and related controls could have had a false sense of protection: messages marked confidential were still being processed for Copilot summaries.
Microsoft said it began rolling out a fix earlier in February, but it hasn’t publicly disclosed how many customers were affected. A company spokesperson did not respond to requests for details, including questions about the scope of impact.
Security anxiety around workplace AI is rising
The timing is uncomfortable for Microsoft as governments and large institutions scrutinize built-in AI features more aggressively. Earlier this week, the European Parliament’s IT department told lawmakers it had blocked built-in AI features on work-issued devices, citing concerns that AI tools could upload sensitive correspondence to the cloud.
Together, these developments underline a broader reality: in enterprise AI, the biggest risk isn’t only what the model says—it’s what the model is allowed to see.