Incidents gathered from public reporting around the world. Each one links to the articles it came from. None of it is a finding that anyone broke the law.
Reports people file about their own experience are not shown here and never will be without their agreement. Tell us what happened to you.
67 incidents involving Microsoft · search all text for “Microsoft Corporation” instead · public reporting
Microsoft and OpenAI scraped and trained on paywalled content, bypassing paywalls and affecting publishers like The New York Times
1 source article · read the reporting →
Residents of Mount Pleasant and Sturtevant, Wisconsin, filed a federal class-action lawsuit against Microsoft over continuous noise from its $7.3 billion Fairwater AI data centre. The complaint describes a constant hum likened to a freight train, as well as construction noise and bright light at night, and says neighbours are kept indoors and lose sleep. Microsoft had held a public Q&A about the noise without offering a fix.
1 source article · read the reporting →
West Midlands Police used Microsoft Copilot to search for information when preparing a report for the Safety Advisory Group about the Aston Villa v Maccabi Tel Aviv fixture. The AI tool generated an erroneous statement about a non-existent previous fixture. This error was included in the report, which influenced the SAG's decision to reduce the away ticket allocation to zero. The Chief Constable denied AI was used, but another interviewee confirmed it was an AI-generated mistake.
2 source articles · read the reporting →
The Register tested Microsoft Recall's sensitive information filter and found it frequently fails to block credit card numbers, passwords, and other personal data. The AI-powered screenshot tool, which is enabled by default on some new PCs, could expose users to identity theft if an attacker gains access. Microsoft declined to comment but has previously acknowledged the filter is not perfect and promised improvements. Privacy advocates warn that vulnerable users, such as domestic violence victims, could be particularly at risk.
2 source articles · read the reporting →
A vulnerability in Microsoft 365 Copilot allowed users to access files without the access being recorded in audit logs, potentially enabling malicious insiders to exfiltrate data undetected. The flaw, discovered by Pistachio's CTO, was reported to Microsoft in July 2025 and fixed in August, but Microsoft decided not to issue a CVE or notify customers. The vulnerability could be triggered accidentally, meaning many organisations' audit logs may be incomplete. Microsoft classified the issue as 'important' but faced criticism for its lack of transparency.
1 source article · read the reporting →
During a power outage caused by substation failure, the Leesburg Data Center operated 62 emergency engines that exceeded permitted emissions limits for NOx, CO, VOC, PM10, and PM2.5, affecting air quality for nearby residents.
1 source article · read the reporting →
A BBC study found that four major AI chatbots – ChatGPT, Copilot, Gemini and Perplexity – produced inaccurate summaries of BBC news articles. The study, conducted in December 2024, found that 51% of AI answers had significant issues and 19% introduced factual errors. The BBC's CEO called on tech companies to pull back their AI news summaries, warning of potential real-world harm. OpenAI responded by stating it supports publishers and helps users discover quality content.
5 source articles · read the reporting →
AI-powered search engines from Google, Microsoft, and Perplexity have been surfacing debunked research promoting race science, including false IQ scores for countries. The systems pulled data from a dataset by Richard Lynn, a known proponent of scientific racism. Google removed the offending Overviews after being contacted by WIRED, but the data still appears in featured snippets and other AI tools.
7 source articles · read the reporting →
Security researcher Michael Bargury demonstrated at Black Hat that Microsoft's Copilot AI can be manipulated by attackers to send phishing emails, extract private data, and bypass security protections. The attacks exploit the AI's access to corporate data and its ability to perform actions on behalf of users. Microsoft acknowledged the findings and said it is working with the researcher to assess the vulnerabilities.
3 source articles · read the reporting →
In August 2024, Lasso Security researchers discovered that Microsoft Copilot could access and expose data from private GitHub repositories that had been briefly public, due to Bing's caching mechanism. The vulnerability allowed anyone to retrieve sensitive information, including secrets and tokens, from over 20,000 repositories affecting more than 16,000 organisations. Microsoft acknowledged the issue but classified it as low severity, removing the public cached link feature while Copilot retained access to the cached data. The researchers alerted affected organisations and advised them to rotate compromised keys.
2 source articles · read the reporting →
A report by Cracked Labs found that Microsoft's Dynamics 365 Field Service software uses AI to generate performance metrics and predict task durations, singling out individual workers. The AI predictions can be influenced by the worker's identity, such as increasing or decreasing estimated duration. Microsoft stated the system is not intended for employment decisions and is not a surveillance tool, but the report raises concerns about potential misuse for worker monitoring.
6 source articles · read the reporting →
Dave Fanning, an Irish DJ and talk show host, is suing Microsoft and BNN Breaking after MSN featured an AI-generated article falsely claiming he faced trial for alleged sexual misconduct. The article was produced by BNN Breaking's AI system without human fact-checking and appeared on MSN's homepage for several hours before removal. Fanning alleges defamation and reputational damage. The lawsuit is pending.
6 source articles · read the reporting →
The UK Information Commissioner's Office (ICO) has issued a statement on 22 May 2024 regarding Microsoft's Recall feature. The ICO is making enquiries with Microsoft to understand the safeguards in place to protect user privacy, expecting transparency and necessity in data processing. This follows concerns that the feature may not adequately consider data protection from the outset before being brought to market.
10 source articles · read the reporting →
Martin Bernklau, a German court reporter, asked Microsoft's Bing Copilot about himself and found that the AI chatbot had falsely accused him of crimes he had covered. The false information persisted despite Microsoft's promises to delete it. Bernklau's lawyer sent a cease-and-desist demand, and the case has been reported to data protection authorities. The incident highlights the problem of AI hallucinations and defamation.
8 source articles · read the reporting →
A report by Democracy Reporting International found that chatbots from Google, Microsoft, and OpenAI provided incorrect election dates and voting information to users ahead of the European Parliament election. The experiment, conducted in March 2024, tested the chatbots in multiple languages and found that they often hallucinated facts. The European Commission subsequently ordered the companies to explain their measures under the Digital Services Act. Google and Microsoft said they are restricting election-related queries.
6 source articles · read the reporting →
A study by the Center for Countering Digital Hate found that leading AI image generators, including Midjourney, DreamStudio, ChatGPT Plus, and Microsoft Image Creator, could be manipulated to create misleading election-related images. The researchers used jailbreaking techniques to bypass safety measures, producing photorealistic images of candidates in compromising situations or of voting fraud. The companies responded by stating they are updating policies and implementing safeguards, but the study suggests existing protections are inadequate.
8 source articles · read the reporting →
Microsoft's Copilot chatbot generated fake press statements attributed to US President Joe Biden and Russian President Vladimir Putin regarding the death of Russian opposition leader Alexei Navalny. A journalist using the tool for a news article received fabricated statements blaming Putin and a rebuttal. Microsoft investigated and stated it is making changes to improve response quality. Neither President actually issued the statements.
10 source articles · read the reporting →
Sexually explicit AI-generated images of Taylor Swift went viral on Twitter after being created using Microsoft's text-to-image AI generator. The images originated from 4chan and a Telegram group dedicated to abusive images of women. Twitter removed the accounts that posted the images after 17 hours, but some examples remain on the platform.
10 source articles · read the reporting →
A Microsoft employee, Shane Jones, submitted a letter to the Federal Trade Commission warning that the company's AI image generator, Copilot Designer, can produce harmful content including sexual, violent, and drug-related imagery from benign prompts. Jones claims he repeatedly urged Microsoft to remove the tool or add disclosures, but the company declined. Microsoft responded that it is committed to addressing employee concerns and enhancing safety.
1 source article · read the reporting →
Users on 4chan's /pol/ board used Microsoft Bing's AI image generator, powered by OpenAI's DALL-E 3, to create images containing Nazi imagery and propaganda. Despite warnings in early October 2023, the activity continued for weeks, with over 100,000 replies in threads linking to the tool. Microsoft and OpenAI stated they were investigating and had policies against harmful content, but the images were shared widely. The incident highlights challenges in moderating AI-generated content.
3 source articles · read the reporting →
Microsoft's Bing Image Creator, a generative AI image tool, was found to produce images of beloved fictional characters such as SpongeBob Squarepants and Mickey Mouse engaging in 9/11-related scenarios. The article reports that users have been able to bypass the system's heavy filters against violence, terrorism, and hate speech. The incident illustrates ongoing struggles with content moderation and copyright in generative AI models.
10 source articles · read the reporting →
Microsoft's AI research team accidentally exposed 38 terabytes of private data, including employee workstation backups and over 30,000 internal Teams messages, due to a misconfigured Azure SAS token on a GitHub repository. The token, which granted full control permissions and was set to expire in 2051, allowed access to the entire storage account instead of just the intended open-source AI models. Security researchers at Wiz discovered the exposure and reported it to Microsoft, who acknowledged the issue. The incident highlights the risks of oversharing data and supply chain attacks in AI development.
1 source article · read the reporting →
Microsoft's MSN news portal published a garbled, AI-generated article about the death of former NBA player Brandon Hunter, with a headline that called him 'useless'. The article was quickly criticized on social media as disrespectful and incoherent. Microsoft removed the article after the incident was reported, stating that they are working to prevent such content in the future.
10 source articles · read the reporting →
Microsoft has built data centers in Goodyear, Arizona, to support AI workloads, including for OpenAI. The data centers use drinking water for evaporative cooling, with projected annual consumption of over 50 million gallons. This raises concerns about water scarcity in the desert region. Microsoft declined to comment on the assertion that the complex is partly designated for OpenAI's use.
8 source articles · read the reporting →
