Microsoft AI Recall feature found to capture credit card numbers

Microsoft's AI-powered Recall feature has been found to capture sensitive information, including credit card numbers and Social Security numbers, prompting concerns about the technology company's integrity. What happened Microsoft's Recall feature, which allows users to retrieve past screen activity through screenshots, was tested by Tom's Hardware. The test demonstrated that Recall captured sensitive data despite having a "Filter sensitive information" setting activated. The filter is intended to block the recording of personal financial details but failed during practical tests, capturing sensitive information from various applications, including Notepad and PDF forms. Why it happened The issues with Recall stem from its underlying technology and the challenges of effectively filtering out sensitive information. While Microsoft has claimed improvements in the feature's ability to detect and exclude such data, the testing showed that it only worked under specific conditions—primarily on certain e-commerce sites. The AI's inability to consistently identify and block sensitive information across diverse contexts appears to reveal a major flaw in its design. What it means The findings raise concerns about Microsoft's governance of Recall and the feature's potential impact on user privacy. If Recall continues to capture sensitive information without adequate safeguards, it could expose users to risks such as identity theft or unauthorised access to personal data. System 🤖 Recall 🔗 Developer: Microsoft Country: UK Sector: Technology Purpose: Identify viewed content Technology: Machine learning Issue: Privacy; Security

Date it happened

2024-12-01

Product, system or model

Recall

This is a record of what was reported, not a finding that anyone broke the law. If it names your organisation and you believe it is wrong, the corrections process is free and open to everyone.