Disclosed vulnerability
Windows Recall's "filter sensitive information" screening failed in testing, leaving passwords, SSNs and card numbers in its local screenshot index
AIR-2025-0074 AIR record · 2025-08-windows-recall-sensitive-filter-failure
From the supporting source
But a *The Register* test shows that it still fails in many cases, creating a potential treasure trove for thieves.theregister.com
The record
Disclosed
2025-08-01
Occurred
2025-08
Vendor
Microsoft
Product
Windows Recall on Copilot+ PCs
Risk domain
Access control and permissions › Credential theft
Also touches
Sensitive data exposure
System type
Generative model
Who acted
Agent acted (contested) — Recall captured, OCR'd and indexed real passwords and card numbers
Attack surface
Agent memory
Autonomy level
Assistant
Initial vector
None autonomous action
Impact type
Privacy violation, Credential exposure
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI03 – Identity and Privilege Abuse
- MITRE ATLAS
- AML.T0012 – Valid Accounts
- NIST AI RMF
- MEASURE 2.7
- EU AI Act
- Article 13
- ISO/IEC
- TR 24028; 42001; 23894
- AIUC-1
- B. Security
- Scope
- tool failure
- Mitigation
- Use secure credential storage; Implement short-lived tokens.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
Copilot+ PC users with Recall enabled; a local, searchable index of everything shown on screen
Capability abused
Defense & remediation
Recorded defense
built-in sensitive-information filter
Guardrail kinds
Unknown
Guardrail outcome
Silent
Fix shipped
none at disclosure; Microsoft classified Recall as preview and said improvements were in progress
Taxonomy & references
Curator notes
impact_realized false — this is a tested control failure, not a breach. It earns a place because Recall is the purest form of the agent-memory problem: to be useful the assistant must retain everything it saw, the only thing standing between that archive and an attacker is a heuristic filter, and the filter does not hold. Redesigned after the 2024 backlash (Kevin Beaumont's original findings) and still failing in 2025. AI Incident Database incident 1176.
Supporting sources
Cite as
Enkrypt AI. "Windows Recall's "filter sensitive information" screening failed in testing, leaving passwords, SSNs and card numbers in its local screenshot index". AIR, AIR-2025-0074. https://agentincident.vercel.app/i/AIR-2025-0074/ (accessed 2026-10-19).