Microsoft confirms Copilot bug exposed confidential Outlook emails: Here's what went wrong 

Microsoft once again came into the spotlight when the company confirmed a bug in Microsoft 365 Copilot, allowing the AI assistant to access and summarize confidential Outlook emails. The company acknowledged the bug in its report, mentioning how the bug continued for several weeks before the company started rolling out a fix. The incident not just raised concern about data privacy, but also about enterprise security, especially for tech giants like Microsoft, where users rely on strict email protection policies.

Bug Allowed Copilot to Process Sensitive Emails

As per reports, Microsoft identified the bug as CW1226324 and it was first detected on 21 January, 2026. Not only it affected the Copilot ‘work tab’, but also implied to code error too. This resulted into Copilot able to read and summarizing emails stored in user’s Sent Items and Draft Folders.

Additionally, it also included emails that were marked as confidential labels. Confidential labels in Outlook are designed in such a way that it restrict access and prevent automated systems from processing sensitive information. Nevertheless, the bug reportedly caused Copilot to ignore this process and protections. Therefore, emails that were even marked confidential were summarized by the AI assistant

Data Loss Prevention Policies Were Bypassed

Organisations use Data Loss Prevention (DLP) policies to protect essential and confidential data. These standards are meant to block unauthorized access. In addition, it also prevents automated processing of protected content and data. In current Copilot scenario, the bud bypassed those safeguards.

The tech giant acknowledged that emails that are labeled as Confidential were being incorrectly processed by Microsoft 365 Copilot chat. The company mentions that the issue was caused by a coding error. While Microsoft didn’t provide detailed technical information behind the bug, it did mention that users were affected. Furthermore, Microsoft also did not reveal how many users or organisations were affected by the issue.

Rolls Out a Fix

The company has started rolling out a fix in early February after monitoring and contacted some affected users to confirm that the issue has been resolved. However, the full impact of the bug remains unclear.

Add Techlusive as a Preferred Source

This issue comes at a time when Microsoft is expanding AI features across its products, including Outlook, Word, Excel, and PowerPoint. Copilot has also been integrated into the Edge browser with additional AI-powered tools.