Incident: A confidential label honoured on one path only

Module 6 · Incident file · About 35 minutes

What happened

From late January 2026 Microsoft 365 Copilot summarised emails that their senders had labelled confidential. The labels exist to keep automated tools out, and the users asking could already open every one of those emails.

On 18 February 2026 Sergiu Gatlan of BleepingComputer reported a Microsoft service alert, tracking ID CW1226324 ("Microsoft says bug causes Copilot to summarize confidential emails", updated 19 and 20 February). The alert said: "Users' email messages with a confidential label applied are being incorrectly processed by Microsoft 365 Copilot chat." It affected the Copilot "work tab" chat and emails in users' Sent Items and Drafts folders, "bypassing data loss prevention (DLP) policies that organizations rely on to protect sensitive information".

Microsoft first detected it on 21 January and began rolling out a fix in early February. On 19 February it said a "configuration update has been deployed worldwide for enterprise customers", and on 20 February that "the root cause of this issue has been addressed for most customers". It did not say how many users or organisations were affected. No post-mortem has been published; everything here is the alert and statements as BleepingComputer quoted them.