Microsoft Copilot spent over a month reading and summarizing confidential emails despite every sensitivity label and DLP policy forbidding it.

Source Brief

Microsoft Copilot spent over a month reading and summarizing confidential emails despite every sensitivity label and DLP policy forbidding it. The UK's National Health Service was among the affected organizations. No security tool in Microsoft's own pipeline caught the failure, highlighting fundamental trust issues with AI assistants.