The reports concern processing of confidential email despite configured protections. They do not establish outside theft, cross-tenant disclosure, or model-training use.
What happened
In February 2026, reporting attributed to Microsoft an acknowledgment that Copilot could process and summarize certain confidential email despite data-protection policies. The associated NHSmail advisory now identifies the issue as resolved.
This distinction matters: inappropriate processing is a serious control issue, but it is not automatically evidence that messages were stolen or disclosed to another organization. The lesson is to examine the actual operation and the specific safeguard that failed.
What a business can learn
A classification label, permission setting, and contractual promise answer different questions. Before connecting a live mailbox, identify the allowed folders, data categories, and actions. Evaluate a representative task with synthetic messages and inspect the result.
- Separate what an account can access from what a particular assignment is allowed to use.
- Test exclusions with fictional information before relying on them for sensitive work.
- Review the service agreement and report unexpected processing rather than assuming labels are sufficient.
A PRACTICAL THADDEUS WORKFLOW
Define the access before assigning the work.
Use a plan to name approved inputs, permitted actions, and review criteria. Connect only the accounts the assignment needs, then inspect the deliverable and the information it contains. This gives your team a concrete process to evaluate rather than a blanket privacy promise.
Try this assignment
Prepare a weekly brief using only these fictional, approved updates. List the inputs you used, exclude the marked internal notes, and leave the result for review. Do not connect a live mailbox or send anything.
A written instruction is not a substitute for enforced access controls. Thaddeus controls and external-service terms must be assessed for the actual workflow; this is not proof that a similar defect cannot occur.
Sources & further reading
- Resolved Microsoft 365 Copilot confidential-email advisory ↗
NHSmail. February 2026 incident; resolved status reviewed October 2, 2026. - Microsoft says Office bug exposed customers’ confidential emails to Copilot AI ↗
TechCrunch. February 18, 2026.
Educational information, not a security audit, professional advice, or guarantee. The assignment is an example to evaluate, not a completed demonstration. Historical incidents and product capabilities do not establish comparative safety. Confirm current policies and agreements for your intended workflow.