FlagThis

Microsoft’s new AI feature ‘Recall’ for Copilot+ PCs stores screenshots of sensitive data, including credit cards and social security numbers, even when a ‘sensitive information’ filter is enabled. This has raised serious privacy and security concerns among users. This feature takes continuous screenshots of everything a user does. The data is stored locally but sent off to Microsoft’s LLM for analysis. This has prompted an investigation by the UK Information Commissioner’s Office. This incident highlights the potential risks of AI-powered surveillance features and the importance of user privacy.

ImgSrc: cdn.mos.cms.futurecdn.net

References:

• Techmeme - Microsoft's new version of Recall appears to still capture sensitive data like credit card numbers, even with the "sensitive information" filter enabled (Avram Piltch/Tom's Hardware) - 13d
• @BenjaminHCCarr - screenshots and numbers ( ), even with the "sensitive information" filter enabled Despite promising to filter personal data out, still captures it. - 13d
• @Techmeme - Microsoft's new version of Recall appears to still capture sensitive data like credit card numbers, even with the "sensitive information" filter enabled (Avram Piltch/Tom's Hardware) - 13d
• Latest from Tomshardware - screenshots credit cards and Social Security numbers, even with the "sensitive information" filter enabled - 13d
• @metacurity - Microsoft Recall screenshots credit cards and Social Security numbers, even with the "sensitive information" filter enabled - 13d
• @PrivacyDigest - screenshots credit cards and numbers, even with the "sensitive information" filter enabled | Tom's Hardware Despite promising to filter personal data out, Recall still captures it - 13d
• TechSpot - Microsoft Recall is capturing screenshots of sensitive information like credit card and social security numbers - 12d
• Techzine Global - Microsoft Recall is still a privacy nightmare - 12d
• Pivot to AI - «When Piltch asked Microsoft about the issues [of sending over sensitive information like credit card numbers] , it referred him to a blog post saying AI makes mistakes» Ah yes, it's perfectly norma - 12d
• @patrickcmiller.bsky.social - Attackers can abuse the Windows UI Automation framework to steal data from apps - 12d
• @davidgerard - Windows AI Copilot+ Recall stores screenshots of sensitive data, regardless of ‘sensitive information’ filter - 12d
• @amycastor - Windows AI Copilot+ Recall stores screenshots of sensitive data, regardless of ‘sensitive information’ filter - 12d
• Vulnerability Archives - Abusing Microsoft’s UI Automation Framework: The New Evasion Technique Bypassing EDR - 12d
• News - Attackers can abuse the Windows UI Automation framework to steal data from apps - 12d
• Five big events shaped Microsoft - Hands on with Microsoft’s Windows Recall: Not impressive yet - 12d

Classification:

• HashTags: Privacy AISurveillance DataBreach
• Company: Microsoft
• Target: Users Private Data
• Product: Windows AI Copilot+
• Feature: AI Recall
• Type: AI
• Severity: Major