Microsoft Copilot Bypassed Data Security Controls Twice in Eight Months

Quick Facts

• Microsoft Copilot ignored sensitivity labels and DLP policies twice in eight months, exposing confidential organizational data
• The latest incident affected the UK’s National Health Service and persisted for four weeks before detection
• Traditional security tools cannot detect when AI assistants violate trust boundaries, creating blind spots for enterprise security teams

Microsoft’s Copilot has failed to respect data security controls twice in eight months, bypassing sensitivity labels and data loss prevention (DLP) policies designed to protect confidential information.

The latest incident, tracked as service advisory CW1226324, occurred between January and February 2026. Customers reported problems on January 21, with Microsoft confirming the issue on February 4. The bug caused Copilot Chat’s work tab to return summaries from messages in users’ Drafts and Sent Items folders, even when those messages carried confidentiality labels and DLP policies.

The UK’s National Health Service logged the incident as INC46740412, demonstrating real-world impact in regulated healthcare environments. Microsoft identified a code-level defect that allowed Copilot to grab labeled items from key folders without proper checks, feeding them into AI summaries despite DLP blocks.

This follows the EchoLeak vulnerability (CVE-2025-32711) discovered in 2025. Microsoft assigned that bug a CVSS score of 9.3 (critical) and patched it in June 2025. EchoLeak allowed attackers to steal sensitive organizational data without user interaction by sending crafted email messages that exploited Copilot’s data retrieval process.

“The chains allow attackers to automatically exfiltrate sensitive and proprietary information from M365 Copilot context, without the user’s awareness,” said Aim Security, the company that discovered EchoLeak. The researchers characterized it as a fundamental design flaw where agents process trusted and untrusted data in the same pipeline.

A 2026 survey by Cybersecurity Insiders found that 47% of CISOs and senior security leaders have observed AI agents exhibit unintended or unauthorized behavior. The findings highlight a broader problem: organizations are deploying AI assistants faster than they can build governance around them.

Traditional security tools create detection gaps for AI trust boundary violations. Endpoint detection and response (EDR) monitors file behavior, while web application firewalls inspect HTTP payloads. Neither has categories for detecting when AI assistants violate their own trust boundaries.

Microsoft rolled out fixes on February 11, 2026, and contacted affected users for validation. However, deployment remains incomplete, leaving security gaps for some organizations. The company stated that access controls and data protection policies remained intact, but acknowledged the behavior did not meet intended Copilot experience standards.

The structural risk extends beyond Copilot. Any retrieval-augmented generation (RAG) assistant pulling from enterprise data follows the same pattern: a retrieval layer selects content, an enforcement layer controls model access, and a generation layer produces output. When the enforcement layer fails, restricted data feeds to the model without security stack visibility.

For organizations in regulated sectors like healthcare, finance, and government, undocumented AI data access gaps during vulnerability windows create audit findings. The incidents demonstrate that AI assistants require new security approaches beyond traditional DLP and monitoring tools.

Read more: Microsoft Copilot ignored sensitivity labels twice in eight months — and no DLP stack caught either one