Loading story…
Microsoft has introduced a new Windows 11 policy that lets IT administrators silently uninstall the Microsoft Copilot app from managed enterprise devices. The setting, exposed as RemoveMicrosoftCopilotApp, became generally available with the April 2026 Patch Tuesday updates and is supported on Windows 11 version 25H2 and later builds including KB5083769. Microsoft says the policy can be deployed through Group Policy, Policy CSP, Microsoft Intune, and System Center Configuration Manager, giving organizations centralized control over Copilot on Pro, Enterprise, Education, and IoT Enterprise systems.
The removal applies only under specific conditions: Microsoft 365 Copilot must also be installed, the Copilot app must not have been manually installed by the user, and it must not have been launched in the previous 28 days. Microsoft described the uninstall as non-disruptive and said users can reinstall the app later, but the action is one-time only, meaning organizations that want to block reinstallation must use additional controls such as AppLocker, Windows Defender Application Control, or Intune uninstall profiles. The change follows broader adjustments to Microsoft's Copilot rollout as enterprise customers push for tighter control over bundled AI features.
Track how attackers are adapting to this technology.
3 events from the most recent confirmed update back to the earliest known activity.
Microsoft updated the RemoveDefaultMicrosoftStorePackages policy to let enterprise administrators uninstall any preinstalled Microsoft Store MSIX/APPX app by specifying its Package Family Name. The change also expanded support to Windows 11 24H2 Enterprise and Education and required at least the April 2026 non-security update, with earlier availability in March 2026 Insider Dev and Beta builds.
By 2026-04-27, Microsoft had publicly shared and documented the new Group Policy and Policy CSP setting for managed Windows 11 environments, clarifying supported editions, one-time uninstall behavior, and that additional controls are needed to block reinstallation. Reporting described the move as part of Microsoft's broader effort to give enterprises more control over Copilot deployment.
On 2026-04-14, Microsoft broadly released the RemoveMicrosoftCopilotApp policy as part of the April 2026 Patch Tuesday updates for Windows 11 version 25H2 and later builds such as KB5083769. The policy lets enterprise IT administrators silently uninstall the Microsoft Copilot app from managed devices under specific conditions, including when Microsoft 365 Copilot is installed and the app has not been used recently.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
3 references tracked. Mallory keeps watching after this page renders.
bleepingcomputer.com
Open sourcecybersecuritynews.com
Open sourceghacks.net
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft has announced a major upgrade to its Copilot AI integration in Windows 11, introducing a new feature called Copilot Actions. This feature enables AI agents to perform real tasks on users' local files and applications, moving beyond simple chatbot interactions to more advanced, agentic capabilities. Copilot Actions allows users to interact with their PC using natural language, voice commands, and visual cues, enabling the AI to open and close apps, update documents, organize files, book tickets, and send emails on behalf of the user. The feature is currently being tested by members of the Windows Insider Program and will eventually be rolled out to all Windows 11 PCs, regardless of whether they are classified as Copilot+ devices. Microsoft has emphasized the importance of security and privacy in the design of Copilot Actions, especially in light of previous controversies such as the Recall feature. To address potential risks, Copilot Actions requires explicit user permission before taking any action, and users retain the ability to control or revoke access at any time. Each AI agent operates within its own isolated Agent Workspace, ensuring that actions taken by one agent do not affect others or the broader system. Agents run under distinct standard Windows accounts with no administrative privileges, and their activities are governed by strict application and file system access rules. Microsoft has also implemented operational trust measures, such as digitally signed agents, and all agent activities are subject to the Microsoft Privacy Statement and Responsible AI Standard. The company is optimizing these workspaces to minimize any impact on system performance and has confirmed that there will be no changes to Windows 11 hardware requirements. The introduction of Copilot Actions represents a significant shift in how users interact with their PCs, transforming AI from a passive assistant to an active digital collaborator. However, this evolution also raises new questions about trust, as users must decide whether to allow AI agents access to sensitive files and applications. Microsoft is addressing these concerns by building in robust security guardrails and transparency around agent actions. The company is taking a cautious approach, learning from past experiences and ensuring that security controls are in place before the feature becomes widely available. As Copilot Actions moves from testing to general availability, Microsoft is expected to continue refining its security and privacy measures based on user feedback and ongoing risk assessments. The rollout of Copilot Actions is part of Microsoft's broader vision to deeply integrate AI into the Windows desktop environment, aiming to enhance productivity while maintaining user trust and system integrity. Security professionals and CISOs should closely monitor the deployment of Copilot Actions, assess the potential risks associated with agentic AI, and ensure that organizational policies are updated to address these new capabilities. The evolution of Copilot in Windows 11 underscores the growing importance of balancing innovation with security and privacy in the age of AI-driven computing.
Jun 29, 2026
New reporting highlighted a **prompt-injection phishing risk** in Microsoft Copilot after Permiso researchers found that attacker-controlled text embedded in emails could manipulate Copilot-generated summaries through cross-prompt injection attacks. The issue could cause Copilot to present deceptive security alerts or malicious instructions inside a trusted Microsoft 365 interface, increasing the likelihood that users will believe and act on attacker content. Separate coverage also noted broader security and privacy concerns around Microsoft’s AI ecosystem, including criticism of Windows Recall for capturing and storing snapshots of user activity that Copilot can analyze, even after Microsoft added stronger protections following earlier backlash. Microsoft also faced continued scrutiny over how aggressively it is pushing Copilot into user environments. The company temporarily halted plans to **automatically install the Microsoft 365 Copilot app** on eligible Windows systems outside the EEA, though existing installations remain in place and administrators can still deploy it manually. Public criticism of Copilot’s quality and Microsoft’s AI strategy also spilled into the company’s Discord community, where moderation actions against users mocking “Microslop” drew further attention to dissatisfaction with rushed AI integration, privacy concerns, and the perception that Microsoft is forcing AI features into products despite unresolved trust and security issues.
Jun 29, 2026
Microsoft is tightening and clarifying how **Copilot** can access and process user and organizational data across the Microsoft ecosystem. Microsoft is expanding **Purview Data Loss Prevention (DLP)** enforcement so policies that block Copilot from processing restricted/sensitivity-labeled content will apply not only to files in **SharePoint** and **OneDrive**, but also to **locally stored** Word, Excel, and PowerPoint documents. The change is planned for deployment via the *Augmentation Loop (AugLoop)* Office component between late March and late April 2026, and is expected to be automatically enabled for organizations already configured to block Copilot from processing labeled content; Microsoft says the update works by allowing the Office client/AugLoop to read sensitivity labels directly rather than relying on Microsoft Graph calls tied to SharePoint/OneDrive URLs. Separately, a Copilot “Memory” setting labeled **“Microsoft usage data”** has been reported as enabling Copilot to reference data from other Microsoft products (including **Bing, MSN, and Edge**) to personalize conversations, with an option for users to disable it if they have privacy concerns. A third, unrelated Microsoft 365 issue—an acknowledged bug in **classic Outlook** that can cause the mouse pointer to disappear—does not materially relate to Copilot data access or DLP controls and appears to be a usability defect rather than a security event.
Jun 29, 2026