Office Bug Exposes Emails to Copilot

🔑 Enhanced Key Takeaways

• •A bug in Microsoft 365's DLP policy for Copilot allowed Copilot Chat to access and expose confidential emails in Sent Items and Drafts folders despite sensitivity labels[1].
• •Customers first reported the issue on January 21, 2026, with Microsoft acknowledging it via service health advisory CW1226324 on February 3, 2026, attributing it to a code issue[1].
• •The glitch bypassed DLP rules designed to exclude emails and documents stamped with Confidential labels from Copilot processing, affecting paying customers[1].
• •Microsoft is actively fixing the problem, highlighting ongoing challenges in ensuring AI tools respect data protection policies in productivity suites[1].
• •This incident underscores privacy risks in AI-integrated tools like Copilot, where software glitches can lead to unintended exposure of sensitive user data[1].

🛠️ Technical Deep Dive

• •The bug stemmed from a code issue in the DLP policy implementation, specifically failing to suppress confidential material in Copilot responses for Sent Items and Drafts folders[1].
• •DLP policy rules are configured to exclude emails, Office documents, or PDFs with Confidential sensitivity labels from Copilot for Microsoft 365 processing[1].
• •Items in other folders beyond Sent Items and Drafts were not affected by this glitch[1].

🔮 Future ImplicationsAI analysis grounded in cited sources

⏳ Timeline