{"schema_version":"0.10.0","id":"LR-2026-0447","record_version":1,"title":"Microsoft 365 Copilot bug raises data security concerns","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":46.3,"score_breakdown":{"source_authority":12.1,"independent_corroboration":7.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":3.0,"completeness":2.88,"unhedged_language":5.0},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true,"record_integrity":true,"eligible":true,"about_this_case":true},"gate_version":"gate-2026-10-18.7","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-11-01","extraction_run_id":null,"evidence_level":{"level":"preliminary","reason":"1 report: Fox News · subject to change","original_document":null,"reports_total":1,"reports_independent":1,"reports_derivative":0,"developing":false,"disputed":false,"rules_version":"evidence-2026-10-29.1","computed_at":"2026-11-01","history":[{"date":"2026-11-01","from_level":null,"to_level":"preliminary","reason":"1 report: Fox News · subject to change"}]},"sources_hash":"0057b8804607c80338bd51256e9849678145e05b80538047b97edf12754034e8"},"system":{"model_name":null,"model_version":null,"developer":"Microsoft","harness":null,"tools_granted":[],"permissions_scope":null,"autonomy_level":"unknown","guardrails_present":[],"deployment_context":"unknown","tier":null,"lifecycle_stage":null,"integration_type":null,"intended_use":"Helps business users summarize content, draft responses and analyze information across Word, Excel, PowerPoint, Outlook and OneNote","safeguard_state":null,"production_intended":null},"event":{"date_occurred":null,"date_disclosed":"2026-03-02","incident_class":"operational_error","failure_class":null,"agent_involved":null,"secondary_failure_classes":[],"trigger":"unknown","duration":null,"detection_method":"unknown","summary":"Microsoft 365 Copilot Chat, an AI assistant used by business users, was found to be summarizing emails marked confidential. Beginning January 21, a coding error caused by internal bug CW1226324 led Copilot to read and summarize emails in the Sent Items and Drafts folders, and the issue bypassed Data Loss Prevention policies. Microsoft says the behaviour did not give anyone access to information they were not already authorised to see, and that its access controls remained intact. A fix began rolling out in early February, and a configuration update was deployed worldwide for enterprise customers. Microsoft has not provided a final remediation timeline or disclosed how many organisations were affected, and the issue was tagged as an advisory.","tags":[],"date_detected":null,"near_miss":null,"root_cause":null,"root_cause_detail":"A coding error in the Microsoft 365 Copilot Chat work tab feature","failure_class_detail":null,"responsible_party":"provider","adversarial_actor":null,"input_provenance":null,"time_to_contain":null,"operations_paused":null,"remediation":null,"precursor_events":null},"impact":{"direct_loss_usd":null,"remediation_hours":null,"records_exposed":null,"third_parties_affected_count":null,"severity":"moderate","harm_class":[],"affected_description":null,"protected_class_involved":null,"data_categories_exposed":[],"loss_range_usd":null,"reversibility":null,"downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://www.foxnews.com/tech/why-microsoft-365-copilot-bug-matters-data-security","publisher":"Fox News","date":"2026-03-02","type":"press","title":"Why the Microsoft 365 Copilot bug matters for data security - Fox News","archived_url":null,"attachment":"first_report","independence":"independent"}],"per_field_confidence":{"system.developer":"C","system.intended_use":"C","event.incident_class":"C","event.root_cause_detail":"C","event.responsible_party":"C","impact.severity":"D","event.summary":"C","system.autonomy_level":"D","system.deployment_context":"D","event.trigger":"D","event.detection_method":"D","context.country":"D","event.date_disclosed":"D","context.denominator_available":"D"},"field_citations":{"system.developer":[{"source_index":0,"quote":"Microsoft says a bug in Microsoft 365 Copilot allowed its AI chat feature to process sensitive emails since late January."}],"system.intended_use":[{"source_index":0,"quote":"The AI assistant helps business users summarize content, draft responses and analyze information across Word, Excel, PowerPoint, Outlook and OneNote."}],"event.incident_class":[{"source_index":0,"quote":"Microsoft says a coding error impacted Microsoft 365 Copilot Chat, specifically the \"work tab\" feature."}],"event.root_cause_detail":[{"source_index":0,"quote":"Microsoft says a coding error impacted Microsoft 365 Copilot Chat, specifically the \"work tab\" feature."}],"event.responsible_party":[{"source_index":0,"quote":"Microsoft says a bug in Microsoft 365 Copilot allowed its AI chat feature to process sensitive emails since late January."}],"impact.severity":[{"source_index":0,"quote":"Beginning Jan. 21, an internal bug labeled CW1226324 caused Copilot to read and summarize emails stored in Sent Items and Drafts folders."}],"event.summary":[{"source_index":0,"quote":"Microsoft says a bug in Microsoft 365 Copilot allowed its AI chat feature to process sensitive emails since late January."},{"source_index":0,"quote":"Beginning Jan. 21, an internal bug labeled CW1226324 caused Copilot to read and summarize emails stored in Sent Items and Drafts folders."},{"source_index":0,"quote":"The issue bypassed Data Loss Prevention policies that organizations rely on to protect private information."},{"source_index":0,"quote":"This did not provide anyone access to information they weren't already authorized to see."},{"source_index":0,"quote":"Microsoft says it began rolling out a fix in early February."},{"source_index":0,"quote":"A configuration update has been deployed worldwide for enterprise customers."}]},"notes_on_gaps":"Single press source (CyberGuy/Fox News, 2026-03-02) relaying a Microsoft statement; no primary Microsoft report was provided. The year of 'Jan. 21' is not stated in the source, so event.date_occurred is omitted. Date of Microsoft's disclosure is not stated, so date_disclosed and date_detected are omitted. Model name, version, harness, autonomy level, deployment context, lifecycle stage, guardrails, detection method, trigger, adversarial actor and whether an autonomous agent was involved are not stated. Affected organisation count, record counts, financial loss, remediation hours and durations are not disclosed. Judgement: incident class and root cause (integration) were inferred from the 'coding error' description; the DLP bypass is recorded as a tag and the failed DLP policy is not mapped to a control id because no listed control matches it. Judgement: A1 'held' maps Microsoft's statement that access controls remained intact. Judgement: remediation controls_added C4 is inferred because the fix stops protected content being returned. Judgement: severity 'moderate' rests on the bounded scope (Sent Items and Drafts) while Microsoft states no unauthorised access occurred. Reversibility and industry/country are not stated and are omitted. Story section omitted, since the source gives little on the sequence beyond the timeline. [case created by the backfill: read by claude-haiku-5-5, backfill-2026-11-01.2, 2026-11-01; not yet reviewed] [2026-11-01: evidence level set: Preliminary (1 report: Fox News · subject to change)]"},"context":{"industry":null,"org_size_band":null,"country":"unknown","denominator_available":false,"denominator":null,"related_incident_ids":[],"systemic_exposure":null,"shared_model_id":null,"upstream_incident_id":null,"incident_evidence":null,"regulatory":null,"coverage":null},"analysis":{"sections":{"timeline":[{"text":"Internal bug CW1226324 begins causing Copilot Chat to read and summarize confidential emails in Sent Items and Drafts folders.","quote":"Beginning Jan. 21, an internal bug labeled CW1226324 caused Copilot to read and summarize emails stored in Sent Items and Drafts folders.","source_index":0,"when":"Jan. 21"}]},"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://www.foxnews.com/tech/why-microsoft-365-copilot-bug-matters-data-security"]}}