Microsoft says Office bug exposed customers’ confidential emails to Copilot AI

Microsoft has acknowledged a significant issue that permitted its Copilot AI to access and summarize users' confidential emails for several weeks without proper authorization. This vulnerability, initially highlighted by Bleeping Computer, enabled Copilot Chat to analyze and outline email content since January, disregarding existing data loss prevention protocols designed to safeguard sensitive information from being processed by Microsoft's large language model. Copilot Chat, a feature for Microsoft 365 subscribers, integrates AI capabilities into popular Office applications like Word, Excel, and PowerPoint. However, the flaw, identified by admins as CW1226324, led to the incorrect handling of email messages marked as confidential, including both drafts and sent communications. Microsoft announced that it began implementing a solution for this issue in early February. Despite the fix, a Microsoft representative did not provide additional insights when asked about the number of customers impacted by this glitch. In light of these developments, the IT department of the European Parliament informed lawmakers that it had restricted the use of built-in AI functionalities on devices issued to them, expressing concerns that these tools could inadvertently upload sensitive correspondence to cloud services.