Safety failure
Realized harm
Microsoft 365 Copilot Chat summarized confidentiality-labelled emails, bypassing DLP and sensitivity-label controls
AIR-2026-0024 AIR record · 2026-01-m365-copilot-confidential-email-summarization
A real party was affected. This incident caused actual consequences, not a demonstrated capability.
From the supporting source
A code issue is allowing items in the sent items and draft folders to be picked up by Copilot even though confidential labels are set in place.bleepingcomputer.com
The record
Disclosed
2026-02
Occurred
2026-01-21
Vendor
Microsoft
Product
Microsoft 365 Copilot Chat (work tab)
Risk domain
Access control and permissions › Privilege escalation
Also touches
Sensitive data exposure
System type
Generative model
Who acted
Agent acted — Copilot ingested and summarized labelled mail, bypassing DLP
Attack surface
Enterprise assistant
Autonomy level
Assistant
Initial vector
Product defect
Impact type
Data exposure, Compliance violation
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI03 – Identity and Privilege Abuse
- MITRE ATLAS
- AML.T0055 – Unsecured Credentials
- NIST AI RMF
- GOVERN 6.1
- EU AI Act
- Article 13
- ISO/IEC
- TR 24028; 42001; 23894
- AIUC-1
- B. Security
- Scope
- tool misuse
- Mitigation
- Apply least-privilege principle; Regular policy audits.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
enterprise M365 tenants; Sent Items and Drafts folders with sensitivity labels and DLP policies applied; count undisclosed
Capability abused
Defense & remediation
Recorded defense
sensitivity labels + DLP policy configured to block Copilot processing
Guardrail kinds
Output filter
Guardrail outcome
Silent
Fix shipped
configuration update deployed worldwide for enterprise customers from early February 2026 (tracking ID CW1226324)
Taxonomy & references
Curator notes
Boundary call, included per the 'when in doubt, include and explain' rule: there is no attacker and no exploit - the assistant autonomously ingested data its governance controls were configured to withhold, i.e. an agent scope violation caused by a product defect. Aggravating factor is that it was silent: no alert fired, and affected organisations only learned of it weeks later from Microsoft's disclosure. Exact disclosure day in early February 2026 not pinned down.
Supporting sources
Cite as
Enkrypt AI. "Microsoft 365 Copilot Chat summarized confidentiality-labelled emails, bypassing DLP and sensitivity-label controls". AIR, AIR-2026-0024. https://agentincident.vercel.app/i/AIR-2026-0024/ (accessed 2026-10-19).