The worry arrives in a predictable shape. You connect Microsoft 365 Copilot to your email and files, and someone in the room asks whether you have just handed an AI a key that walks past your access controls and reads through your encryption. It is a reasonable fear. It is also, in the normal case, wrong. The honest answer is more boring and more uncomfortable than the headline: Copilot mostly bypasses nothing. It reads what the signed-in user could already read, only faster, and at a scale no human ever bothered to reach.

That boring answer is the interesting one, because it moves the problem from "the AI broke in" to "we left the doors open and never noticed."

What Copilot Actually Does

Microsoft is unusually direct about the mechanics. Copilot reaches your content through Microsoft Graph, and Graph enforces the same identity-based access boundary as the rest of Microsoft 365. In Microsoft's own words, Copilot "only accesses data that an individual user is authorized to access" and "doesn't access data that the user doesn't have permission to access." It surfaces organisational data only where the user has at least view permission. There is no master key.

Encryption holds, too. When content is encrypted by Microsoft Purview Information Protection, Copilot honours the usage rights granted to the user rather than decrypting around them. Microsoft's most protective tier, Double Key Encryption, is simply out of reach: Copilot cannot return content protected by it, and cannot operate in an app while such a document is open. Data stays encrypted at rest and in transit by the same machinery as before.

So if nothing is bypassed, where is the risk? It is in the word "already." Most organisations have years of SharePoint sites, Teams channels and shared drives whose permissions drifted wide and were never tightened, on the quiet assumption that nobody would ever read all of it. Copilot reads all of it, instantly, on request. The finance folder a contractor was added to in 2021, the HR document shared with "everyone in the org" for one meeting: none of that is a breach. It was always visible. It just took an agent at machine speed to make the oversharing legible.

When The Controls Did Break

The reassuring version above is the design. Designs have bugs, and one landed squarely on this topic.

Between January and February 2026, Microsoft acknowledged an advisory tracked as CW1226324. A code error let Microsoft 365 Copilot Chat read and summarise emails in a user's own Sent Items and Drafts that carried a Confidential sensitivity label, even though a Data Loss Prevention policy was configured to keep that content away from Copilot. Microsoft's description was plain: a code issue allowing items in the sent items and drafts folders to be picked up by Copilot even though confidential labels are set in place. Customers first reported it on 21 January 2026, and the fix began rolling out in early February. The UK's National Health Service confirmed it was affected.

It is worth being precise about what broke, because precision is the whole point. This was not Copilot leaping a permission boundary into someone else's mailbox. It was the user's own content, which they were always authorised to see. What failed was the control meant to stop the agent from processing that content despite the user's access. The label and the policy together said "a human may read this, an agent may not." The bug ignored the second half.

The Threat Model That Actually Matters

That distinction, between being allowed to see something and being allowed to have a machine process and repackage it, is the centre of the real threat model. Traditional Data Loss Prevention was built to watch files leaving: an attachment, a download, a copy to a USB stick. It was not built to watch how an agent reads, interprets, summarises and re-emits the same data in a new shape. An agent that paraphrases a confidential contract into a chat reply has not moved a file in any way a classic rule recognises.

Two named pieces of research show how that gap gets used. At Black Hat USA 2024, Michael Bargury of Zenity demonstrated, in talks titled "15 Ways to Break Your Copilot" and "Living off Microsoft Copilot," how a crafted email could turn Copilot into a willing insider, searching for sensitive data and smuggling it out inside a link the victim was lured into clicking. In June 2025, Aim Labs disclosed "EchoLeak," tracked as CVE-2025-32711 with a CVSS score of 9.3: a zero-click attack in which a single email caused Copilot to leak data from its access scope with no user action at all, by defeating Microsoft's own prompt-injection classifier. Microsoft fixed it and reported no exploitation in the wild.

Both attacks share a feature. They do not break encryption or steal credentials. They abuse the agent's legitimate access through prompt injection, which is the genuinely new surface here, and which the older controls were never designed to see.

One Platform, One Failure Domain

The CW1226324 bug carries a lesson that is easy to lose in the relief of a quick fix. The sensitivity label, the policy and the AI that ignored both all live inside the same vendor's platform. When the safeguard and the thing it guards share a code base, a single code error can disable the guard and expose the asset in the same moment. There is no independent party watching from outside the platform, because the platform is also the auditor.

This is not an argument against Microsoft 365, which remains the most practical place for most organisations to run this. It is an argument about concentration. The World Economic Forum's Global Cybersecurity Outlook 2026 found that data leaks associated with generative AI are now the leading gen-AI security concern among the leaders it surveyed, named by 34 percent, up from 22 percent a year earlier. The concern has a structural reason. As labels, policy, identity and AI converge into one stack, the blast radius of one bug grows, and the value of a backstop that does not depend on that same stack grows with it.

What You Can Actually Do

None of this calls for panic, and none of it is solved by switching the agent off. It calls for ordinary, unglamorous work, done before the agent is switched on rather than after.

Right-size permissions first. Treat the rollout of an agent as the deadline you never had for cleaning up SharePoint and Teams access. Copilot does not create the over-permission problem, it reveals it, so fix the thing it reveals.

Use the controls that are built for agents. Microsoft lets you keep content away from agents through encryption usage rights: the EXTRACT right, shown to users as "Copy," determines whether Copilot can return text from protected content, and Double Key Encryption holds the most sensitive material out of reach entirely. These are not theoretical, they are the documented mechanism.

Treat policy controls as one layer, not the layer. CW1226324 is the evidence that a control inside the platform can fail quietly. Assume any single safeguard can break, and keep at least one form of monitoring or governance that does not depend on the same platform being correct.

The Intersection We Work At

This is the bridge we spend our time on, from first-line operations to future strategy. The strategy conversation about AI agents tends to live in the abstract, in slides about transformation. The operational reality is a contractor still sitting in a finance folder from 2021, and a policy rule that did exactly what its code said, which was not what the people who wrote the policy intended.

We work in the gap between those two. The useful answer to "does the agent bypass our security" is not yes or no, it is "show me your permissions, your labels and your one independent backstop, and then we will know." Agents are worth adopting. They are worth adopting on top of access you have actually looked at, with at least one control that does not sit in the same box as the thing it is guarding. That is less exciting than the headline, and it is the work that holds together in practice.

References