Microsoft’s recall feature still captures sensitive data, the report suggests

Microsoft finally rolled out its artificial intelligence (AI)-powered Recall feature last month with the Windows 11 Insider Preview update. But contrary to Microsoft’s claims that the updated version won’t store sensitive information like credit cards or passwords, a new report suggests this security measure rarely works. There have been multiple reported cases of the AI ​​feature saving snapshots of credit card information and social security numbers, even with the Filter sensitive information setting enabled.

Tom’s Hardware describes the experience with the updated version of Microsoft’s Recall feature in a report. The publication highlights that they encountered an instance of the AI ​​feature that captured a screenshot of sensitive information when they entered credit card details and random login details into the Notepad app. In this case, the words “Capital One Visa” were written right next to the information. The report clarifies that this happened when using both fake and legitimate credit card information.

On another occasion, the publication filled out a PDF of a loan application in the Microsoft Edge browser. This included contact details, date of birth and social security number. Yet another example of Recall not filtering out confidential information occurred when an HTML page was created with a web form that required users to “enter [their] credit card number below”. It included text fields for entering the credit card type, number, CVC, and expiration date.

The report claims that Microsoft’s AI software also captured a snapshot of these details.

However, two cases were also recorded where Recall’s security filter fulfilled its purpose. This was reported on the online payment pages of two platforms: Pimoroni and Adafruit. The AI ​​function took snapshots of the screen before and after filling in the details, but not while filling in the details.

Recall was first introduced at the Microsoft Surface and AI event in May and was withdrawn from Windows test builds a month later due to privacy and security concerns. The Redmond-based tech giant halted the rollout to Windows Insiders. Last month, Copilot+ PCs running Windows 11 Insider Preview Build 26120.2415 (KB5046723) rolled out to the Dev Channel. Microsoft emphasized that snapshots remain on the device and are not sent to Microsoft or third-party servers, or used to train AI models or other functions.