Microsoft Copilot Ignored Sensitivity Labels, Processed Confidential Emails

Microsoft 365 Copilot contained a bug (CW1226324) that caused Copilot Chat’s “Work” tab to read and summarize confidential emails from users’ Sent Items and Drafts even when sensitivity labels and DLP policies were configured to block AI processing; remediation was slow, the NHS flagged the issue internally, and the scope of affected organizations remains unclear, highlighting a critical governance gap where platform-native controls failed and independent AI governance is needed.