Copilot Confidential: When AI Reads Your Sensitive Emails

This Week in IT

This Week in IT

LISTEN ON:

Microsoft 365 Copilot has been caught reading confidential emails it was supposed to ignore, an alarming privacy blunder. Meanwhile, Chinese hackers exploited a backdoor in Dell’s backup software for 18 months without anyone noticing. And as Broadcom hikes VMware prices, IT leaders are looking to reduce reliance on it.

Thanks to Cayosoft for sponsoring this episode!

Links and resources

Episode overview

This Week in IT, I cover three major IT and enterprise technology stories:

1. Microsoft 365 Copilot Confidential Email Bug

A bug caused Copilot to summarize emails that were marked confidential by Microsoft’s own Data Loss Prevention (DLP) system, specifically in Outlook’s Sent and Draft folders. This undermines the purpose of confidentiality labels, which are intended to restrict access, including from AI tools.

IT administrators discovered the issue and reported it to Microsoft in late January. Microsoft began rolling out a fix in early February and is actively monitoring affected organizations. While the number of reported cases is small, the actual scope remains unclear. The incident raises broader questions about trusting AI with sensitive data and whether the fault lies with DLP enforcement or Copilot itself.

2. Dell RecoverPoint Exploited by Chinese State-Linked Hackers

We detail a serious security lapse in Dell RecoverPoint for Virtual Machines, a backup and recovery product. The software contained hard-coded administrator credentials in its Apache Tomcat–based web service. The flaw was exploited by a Chinese state-linked hacking group, giving them root-level access and enabling the installation of persistent backdoors.

Attackers reportedly remained undetected for up to 18 months, gradually upgrading their malware to avoid detection. Fewer than a dozen organizations are currently confirmed as breached, but the total impact is still unknown. Dell has issued patches and urgent mitigation guidance, with U.S. government systems mandated to apply fixes by February 21.

3. VMware Price Hikes Drive Diversification Strategies

In the final story, we discuss the ongoing fallout from Broadcom’s acquisition of VMware. While there hasn’t been a mass exodus, IT leaders are increasingly concerned about rising prices, future direction, support quality, subscription licensing, and product bundling changes.

Based on a survey of over 300 large IT firms, the majority cite VMware price increases as a major disruption. In response, organizations are actively diversifying their virtualization strategies and moving workloads to public cloud platforms like Azure and AWS, or to Microsoft Hyper‑V and Azure Stack. The goal is to reduce vendor lock-in and maintain flexibility if VMware costs continue to rise.