Microsoft 365 Copilot Bug Bypassed Email Sensitivity Labels and DLP to Summarize Confidential Messages

Microsoft confirmed a Microsoft 365 Copilot Chat bug that caused the Copilot work tab to incorrectly read and summarize users’ emails from Sent Items and Drafts, even when those messages had confidential sensitivity labels and organizations had data loss prevention (DLP) policies intended to prevent such processing. The issue was tracked as admin-visible incident CW1226324, first detected in late January, and was attributed to an unspecified code error that allowed labeled items to be picked up by Copilot despite protections being in place.

Microsoft said it began rolling out a fix in early February and was still monitoring deployment while validating remediation with a subset of affected users; the company did not disclose how many customers were impacted or provide a firm timeline for full resolution. Separate reporting noted heightened institutional concern about built-in AI features handling sensitive correspondence (e.g., the European Parliament IT department blocking AI features on work devices), underscoring governance and data-handling risk when AI assistants can process content contrary to configured controls.