Microsoft Copilot AI Exposes Sensitive Data During Low Supervision Periods
Gartner researcher Dennis Xu reported that Microsoft Copilot can expose passwords and confidential emails, particularly when used during low-supervision periods such as Friday afternoons and weekends. Xu recommended that organizations restrict Copilot usage during these times, noting that the system amplifies known risks related to excessive sharing of sensitive documents.
What happened
Dennis Xu, a Gartner research analyst, presented findings at a Gartner panel in Sydney titled "Mitigating the Top 5 Microsoft 365 Copilot Security Risks" regarding vulnerabilities discovered in Microsoft Copilot.
Xu reported that Copilot can generate incorrect information, expose passwords, and divulge confidential emails. He observed that the system makes shared documents excessively accessible, amplifying a known but previously less severe risk.
Reported impact
Copilot's errors can pass unobserved during low-supervision periods, particularly Friday afternoons and weekends, potentially exposing sensitive information or producing erroneous results with real impact in corporate and government environments.
The vulnerability is of particular concern given increasing deployment of such systems in companies and public institutions.
Index analysis
Xu spent 30 minutes of his presentation discussing five risks, of which 20 minutes were dedicated to Copilot's propensity to expose sensitive data.
Experts concluded that the risk of unrestricted use during low-supervision periods extends beyond Copilot to all AI programs, and that lack of human oversight outside working hours can amplify risks when systems are used for tasks involving sensitive information.
Governance controls
Dennis Xu recommended that firms restrict Copilot use on Friday afternoons and weekends due to reduced monitoring levels during these periods.
Experts concluded that recommendations to avoid AI use during low-supervision intervals should be extended to all artificial intelligence programs.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.