When AI Breaks Its Promises. The Copilot Confidential Email Incident and What It Teaches Us About Privacy Risk
The Microsoft 365 Copilot vulnerability highlights a new era of privacy risk. Confidential emails protected by DLP policies were still processed for AI summarization, exposing a gap between intended controls and actual AI behavior.
For privacy leaders, this is the shift. Incident management must now account for AI systems that operate beyond governance expectations. It is no longer enough to trust the tool. Organizations must be able to verify that AI respects privacy controls.