Copilot Summarizes Confidential Emails Ignoring DLP

• Bug Mechanism: A code error allows items in Sent Items and Draft folders to be picked up by Copilot even when confidential labels are applied[1]
• Affected Feature: The 'work tab' Chat feature in Microsoft 365 Copilot Chat, which provides AI-powered content-aware chat interactions[1]
• Data Access Scope: Copilot Chat in Outlook can access emails, calendar, meetings, chats, and limited file content from OneDrive and SharePoint[3]
• Protection Layer Bypass: The bug bypasses both sensitivity label restrictions and configured DLP policies that are meant to prevent ingestion of sensitive information into the language model[1][2]
• Enterprise Data Protection (EDP): Microsoft 365 Copilot Chat offers EDP at no extra cost, which should protect prompts, responses, and uploaded files by storing them in users' OneDrive for Business[3]
• Permissions Model Failure: The incident reveals a vulnerability where the permissions model failed to honor access controls that should prevent unauthorized processing of confidentially-labeled content[4]

This incident raises significant concerns about the trustworthiness of AI-powered enterprise tools and their ability to respect data governance frameworks. Organizations may become more cautious about deploying Copilot features in sensitive environments, particularly in regulated industries requiring strict data handling compliance. The incident demonstrates that even with multi-layered defense strategies including encryption and logical isolation, implementation errors can expose sensitive data[4]. This may accelerate industry-wide demands for more rigorous security testing of AI features before rollout, stricter transparency requirements from vendors regarding security incidents, and potentially increased regulatory scrutiny of AI tools in enterprise environments. The European Parliament's decision to block built-in AI features on work devices due to similar concerns suggests broader organizational hesitation about cloud-based AI processing of confidential content[2]. Future enterprise AI adoption may depend on vendors demonstrating more robust data protection mechanisms and faster incident response protocols.