Security brief

Copilot Chat incident showed confidential-email labels were not being enforced as intended

REVIEW

Microsoft’s reported service notice concerned email summarization despite configured sensitivity labels and DLP rules.

Published 29 Oct 2026 · Material update 18 Feb 2026 — last time the underlying evidence changed · Evidence: medium

What happened

The Register reported in February 2026 on Microsoft service issue CW1226324. Copilot Chat’s work experience was summarizing some emails labeled confidential despite data-loss-prevention policies intended to prevent that processing.

The report describes a service-policy enforcement problem, not proof that all affected emails were sent to external attackers. A user being allowed to read a message does not necessarily mean an organization permits an AI service to process it.

Administrators should consult their tenant’s service-health history and current Microsoft guidance, then validate the actual behavior of sensitivity labels and DLP rules. Historical service reporting should not be treated as a statement that the same defect remains active today.

Read the original source.

Next step

Review tenant service notices and test label and DLP enforcement in Copilot workflows.

What remains unknown

Open question
The sources reviewed do not establish whether your deployment was exploited.

Source references