Microsoft Office Bug Exposed Confidential Emails to Copilot AI: What You Need to Know

Microsoft has confirmed that a bug in Microsoft 365 Copilot allowed the AI assistant to read and summarize customers’ confidential emails for weeks, even when organizations had explicitly configured policies to keep those emails away from the AI. The flaw, tracked by administrators as CW1226324, is a clear example of a new category of risk: as AI gets woven into everyday work software, a single coding error can quietly hand sensitive data to a system that was never supposed to see it. Here’s exactly what happened, who was affected, what Microsoft did, and how to protect your organization.

This matters beyond one bug. It arrived alongside a separate, more serious Copilot vulnerability disclosed months later, and together they point to a pattern worth understanding for anyone using AI features at work.

What happened with the Microsoft Copilot email bug?

In early 2026, Microsoft 365 Copilot Chat, the AI feature that paying customers use inside Word, Excel, PowerPoint, and Outlook, began incorrectly processing emails that carried a “confidential” sensitivity label. Normally, organizations use Data Loss Prevention (DLP) policies to stop Copilot from ingesting sensitive material into Microsoft’s large language model. This bug bypassed those protections.

According to Microsoft’s service health advisory, the root cause was a “code issue” that allowed items in the Sent Items and Drafts folders to be picked up by Copilot despite confidential labels being applied. Emails in other folders weren’t affected, but because sent messages and drafts often contain entire threads, the exposure could include incoming content within those conversations. As TechCrunch first detailed, Copilot Chat could read and outline these emails without permission, defeating the exact safeguard customers relied on.

Who was affected, and for how long?

The bug affected paying Microsoft 365 Copilot Chat customers whose organizations used confidential sensitivity labels and DLP policies. Customers first reported the problem around January 21, 2026, and Microsoft’s advisory followed on February 3, meaning the flaw was active for several weeks before it was publicly confirmed on February 18.

Crucially, Microsoft declined to say how many customers were affected. For regulated industries, law, healthcare, finance, where confidentiality labels protect privileged or sensitive data, even a limited, accidental exposure can carry compliance consequences. This is precisely the scenario that data privacy management software and DLP controls exist to prevent, which is what made the failure so notable.

What did Microsoft do to fix it?

Microsoft confirmed it began rolling out a fix in February 2026, describing the remediation as “saturating” across affected environments, its term for a software update reaching all the servers that need it. By mid-February, Microsoft said users had reported the deployed fix resolved the issue. Administrators can reference the incident in the Microsoft 365 admin center under the tracking code CW1226324.

If you’re an admin, it’s worth confirming the fix reached your tenant and reviewing whether any confidential content was processed during the exposure window. For organizations weighing how their Microsoft 365 setup and AI features are licensed and configured, our guide to Office 365 licensing models is a useful companion.

This wasn’t isolated: the SearchLeak vulnerability

The accidental DLP bug was not Copilot’s only 2026 security problem. In June 2026, researchers at Varonis Threat Labs disclosed a far more serious, attacker-exploitable flaw in Microsoft 365 Copilot Enterprise, dubbed “SearchLeak” (CVE-2026-42824). Unlike the accidental CW1226324 bug, SearchLeak could let attackers silently exfiltrate emails and even multi-factor authentication (MFA) codes by tricking a user into interacting with a malicious link. Microsoft patched it in the June 2026 security updates and urged organizations to apply them immediately.

The two incidents together illustrate the core lesson: the same AI features designed to help workers find and summarize information can become channels to leak or steal it. Security experts quoted by Cybernews warned that the rapid spread of AI assistants and agents across business software is quietly widening the attack surface, and predicted a wave of legal action over improperly accessed data. The risk grows as AI shifts from passive assistants to autonomous agentic AI that can act on its own.

How to protect your data from AI-related exposure

Whether or not you were affected, these incidents are a prompt to tighten how AI touches your sensitive data:

Apply updates immediately. Both Copilot flaws were fixed through updates, so keeping Microsoft 365 and your systems current is the single most important step, the same discipline behind staying on top of issues like the Windows Secure Boot certificate changes. Review Copilot and DLP settings. Confirm your sensitivity labels and DLP policies are working as intended, and verify the CW1226324 fix reached your tenant. Limit AI access to your most sensitive data where the workflow allows, rather than assuming default protections are airtight. Monitor and audit what AI tools can access, especially in regulated environments. For the foundational principles, our cybersecurity and data privacy guide covers how to think about protecting data in an AI-saturated workplace, and our overview of Microsoft’s broader AI agent push shows how deeply these features are being embedded.

The bottom line

The Microsoft Copilot email bug is a reminder that even trusted, mainstream productivity tools can mishandle sensitive data when AI is bolted into them, and that the safeguards you configure are only as reliable as the code enforcing them. Microsoft fixed both the accidental DLP bug and the more dangerous SearchLeak flaw relatively quickly, but the broader trend is unmistakable: AI integration is creating new privacy and security exposure faster than many organizations can audit it. Vigilance, prompt patching, and a healthy skepticism about how much sensitive data your AI tools can reach are now essential parts of workplace security.

FAQ

What was the Microsoft Copilot email bug?

It was a flaw in Microsoft 365 Copilot Chat (tracked as CW1226324) that caused emails with a “confidential” sensitivity label in users’ Sent Items and Drafts folders to be incorrectly processed by the AI, bypassing the Data Loss Prevention policies meant to block them. Microsoft confirmed it on February 18, 2026, and has deployed a fix.

Was my email exposed by the Copilot bug?

The bug affected paying Microsoft 365 Copilot Chat customers whose organizations used confidential sensitivity labels. Only Sent Items and Drafts folders were involved. If you’re an administrator, you can check the incident under tracking code CW1226324 in the Microsoft 365 admin center to see if your tenant was affected.

Has Microsoft fixed the Copilot email bug?

Yes. Microsoft began rolling out a fix in February 2026 and reported that the remediation resolved the issue across affected environments. Administrators should confirm the update reached their tenant and review any confidential content processed during the exposure window.

What is the SearchLeak Copilot vulnerability?

SearchLeak (CVE-2026-42824) is a separate, more serious Microsoft 365 Copilot Enterprise flaw disclosed by Varonis Threat Labs in June 2026. It could let attackers silently steal emails and MFA codes by tricking users into clicking a malicious link. Microsoft patched it in the June 2026 security updates and urged immediate installation.

How can I protect my data from AI tools like Copilot?

Apply all security updates promptly, review your Copilot and DLP policy settings, limit AI access to your most sensitive data where possible, and audit what AI tools can reach, especially in regulated industries. Treat configured protections as something to verify rather than assume, since a code bug can bypass them.