Microsoft's Windows Recall Allegedly Stores Passwords and Social Security Numbers in Preview Mode

Microsoft's Windows Recall, an AI-powered screenshot and retrieval tool for Copilot+ PCs, was allegedly still capturing sensitive information such as passwords, Social Security numbers, and bank details despite a built-in "filter sensitive information" feature. Independent testing reportedly found the filter failed in multiple cases. Microsoft reportedly classified Recall as a preview feature and said improvements were in progress.

Risk classification

• Primary risk domain: 2 Privacy & Security
• Primary risk subdomain: 2.1 Compromise of privacy by obtaining, leaking or correctly inferring sensitive information

The Recall feature captures and stores highly sensitive personal data, including financial details, passwords, and SSNs, failing to filter them and exposing them to unauthorized access.

Additional risk subdomains

• 7.3 Lack of capability or robustness: The core failure stems from the AI filter's lack of capability to robustly identify and exclude sensitive information under varying formatting conditions.

Causal factors

• Entity: AI
• Intent: Unintentional
• Timing: Post-deployment

The privacy risks are caused by the failure of the AI-powered sensitive information filter to correctly identify and redact private data, which is an unintentional and unexpected outcome of the system's deployment.

EU AI Act risk tier

• Risk tier: 4 Minimal or No Risk

Minimal or No Risk: The system is a general-purpose operating system search and productivity utility, which does not fall under the prohibited or high-risk categories defined in the Act.

AI system and alleged parties

• AI system: Windows Recall (Microsoft)
• AI purpose: Activity Tracking; Content Search
• Behaviour type: Tool
• Alleged developer: Microsoft
• Alleged deployer: Microsoft
• Alleged harmed parties: Windows Recall users, Windows 11 users, Microsoft users

Harm severity

Severity ratings are based on this scale.

Highest direct severity in any category: Minor. Severity is scored from Negligible to Catastrophic in each harm category, for harm the reports describe as caused directly or indirectly by the AI system.

• Physical: direct Negligible, indirect Negligible
• Infrastructure: direct Negligible, indirect Negligible
• Property: direct Negligible, indirect Negligible
• Financial: direct Negligible, indirect Negligible
• Environmental: direct Negligible, indirect Negligible
• Malicious content: direct Negligible, indirect Negligible
• Differential treatment: direct Negligible, indirect Negligible
• Civil rights: direct Negligible, indirect Negligible
• Democracy: direct Negligible, indirect Negligible
• Privacy: direct Minor, indirect Minor
• Psychological: direct Negligible, indirect Negligible
• Epistemic: direct Negligible, indirect Negligible
• Child sexual exploitation and abuse: direct Negligible, indirect Negligible

Privacy

Reported: The reports explicitly describe privacy risks and failures of the sensitive information filter, which captured bank details, passwords, and SSNs during testing.

Directly caused: During testing, the Recall app directly captured sensitive personal information including bank balances, transaction histories, usernames, and partially redacted Social Security numbers.

Indirectly caused: The storage of these screenshots in a database accessible via PIN or remote desktop software exposes users to potential unauthorized access and identity theft.

Inferred additional harm: It is highly likely that many early adopters of Copilot+ PCs have had their private data captured and stored insecurely without their full awareness, exposing them to potential future privacy breaches.

People affected

• Occurrences reported: 1
• People reportedly exposed: 2

Potential causes

Management

• Pushing Preview App in OOBE: Promoting an unfinished preview app during default Windows onboarding.
• Prioritizing Utility over Security: Releasing continuous screenshotting before fixing critical security flaws.

Technology

• Flawed Sensitive Info Filter: The AI filter fails to block sensitive data if context clues are missing.
• Weak Authentication Fallback: Allowing PIN fallback instead of biometrics exposes data to unauthorized users.
• Vulnerability to Remote Access: Remote tools like TeamViewer can access Recall history using just a PIN.

Data Inputs

• Lack of Contextual Metadata: The AI relies on explicit labels like 'password' to filter sensitive data.
• Unstructured Screen Content: Screenshots contain unpredictable layouts that bypass standard AI filters.
• Obstructed Visual Data: Partially covered sensitive documents bypass visual detection filters.

Human Factors

• Insecure Local Storage Habits: Users storing passwords in plain text files are exposed by Recall captures.
• PIN Sharing or Guessing: Sharing or weak PINs allow malicious actors to access encrypted Recall data.
• Unaware of Default Capture Risks: Users may not realize Recall captures private browsing and medical history.

Process and Methods

• Inadequate Testing of Edge Cases: Filters were not robustly tested against varied document layouts and prefixes.
• Ineffective App-Control Design: Recall lacks mechanisms for external apps to prevent screenshot capture.

Information quality

• Classification confidence: High
• Reason for confidence: The reports provide clear, first-hand testing results from a technology journalist who documented specific inputs and outputs. The technical mechanisms of the Recall feature, its security model, and its failures are described in detail, leaving little ambiguity about the system's behavior.
• Ambiguities identified: None of significance; the testing methodology and results are clearly explained.
• Alternative interpretations: One could argue that the failures are due to the preview status of the software rather than inherent flaws in the AI design, though the deployment to end-users via OOBE makes this distinction less relevant.

Microsoft's Windows Recall feature fails to reliably filter sensitive personal data, creating a local repository of screenshots containing passwords and financial details. While presenting notable privacy risks to individual users, the national security impact is minor and manageable through standard corporate and government IT security policies.

• Overall national security impact: Minor
• Scope: Multiple nations
• Primary target: No clear primary
• Other affected: Multiple nations
• Alleged perpetrator: Unknown

Threat characteristics

• Imminence: Long-term. Represents an ongoing software vulnerability and data exposure concern rather than an active, immediate crisis.
• Autonomy: Human-supervised. The AI tool automatically captures and processes screenshots in the background, but operates under user-defined settings and can be disabled.
• Novelty: Evolved capability. Represents a significant evolution in OS-level data tracking and semantic indexing, combining traditional screen scraping with local AI.

Impact by dimension

• Physical security: Negligible. The incident involves a local data indexing feature and does not pose any threat to physical systems, critical infrastructure, or kinetic safety.
• Information security: Minor. Insecure storage of screenshots containing credentials poses a minor intelligence risk if government or military endpoints are compromised, though manageable via standard IT policies.
• Sovereignty: Minor. Potential for exposure of government employee credentials on official devices, but easily mitigated by administrative disabling of the feature.
• Economic security: Minor. Risk of financial data exposure for individual users, but does not threaten macro-economic stability or strategic technology control.
• Societal stability: Minor. Creates localized privacy risks, particularly for vulnerable individuals like domestic abuse victims, but does not represent state-level mass surveillance or systemic oppression.