Microsoft Recall exposes sensitive data despite security improvements
Microsoft's Windows Recall feature, which captures user activity screenshots, reportedly still exposes sensitive user data to unauthorized access despite claimed security improvements. Cybersecurity experts say the TotalRecall Reloaded tool can breach Recall's database, though Microsoft denies security flaws exist.
What happened
Windows Recall, an AI feature that captures screenshots of user activity on Copilot+ PCs, reportedly still exposes sensitive data despite security improvements made by Microsoft.
According to cybersecurity experts, the TotalRecall Reloaded tool can force user authentication prompts leading to Recall data extractions, while Microsoft has denied that security flaws exist.
Reported impact
The security vulnerabilities reportedly allow unauthorized access to Recall's database containing screenshots of user activity.
Index analysis
Experts describe the security architecture as having strong encryption ('titanium vault door') undermined by weaker protections elsewhere ('drywall wall').
Governance controls
Microsoft has denied that there are any security flaws in the Recall tool.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.