Dr. Angie Raymond

🦔 Microsoft confirmed a bug allowed its Copilot AI to read and summarize customers' confidential emails for weeks, even when data loss prevention policies were in place to prevent sensitive information from being ingested into the model. The bug, active since January, meant draft and sent emails with confidential labels were being processed by Microsoft 365 Copilot Chat despite explicit protections. Microsoft began rolling out a fix earlier this month but hasn't said how many customers were affected. Meanwhile, the European Parliament's IT department blocked built-in AI features on lawmakers' work devices this week, citing concerns about confidential correspondence being uploaded to the cloud. My Take This is exactly the kind of thing I've been worried about with AI integration being rushed into every product. You set up data loss prevention policies specifically to keep sensitive information contained. Then a bug bypasses all of it and feeds your confidential emails to an LLM anyway. The controls you thought you had weren't actually working. Microsoft has been aggressive about pushing Copilot into everything, and that pace creates risk. Every new integration point is a potential security hole. Every feature rushed to market is something that might not be fully tested. When the European Parliament is blocking AI features on work devices because they don't trust where the data is going, that's a signal worth paying attention to. The more access we give these systems to sensitive information, the more damage a single bug can cause. And we're still in the early days of finding out where all the bugs are. Hedgie🤗

I'm pretty sure everyone at my company saw this article and now they all think we're in an AI crisis. We're not in an AI crisis. We use Claude to summarize Slack threads. But here's what's actually interesting: this whole panic reveals something nobody wants to admit. Every company in America has been bullshitting about their "AI strategy" for two years. We all saw the hype. We all knew we had to say something. So we rebranded our existing automation as "AI-powered" and called it a day. My company isn't special. We're all doing the same thing. The problem is now the executives actually believe their own bullshit. They think we have "significant AI exposure" because they've been telling investors we're "AI-first." I just got pulled into an emergency meeting. Six executives asking me to explain our "AI dependency matrix." There is no AI dependency matrix. There's Claude for meeting summaries, there's some sentiment analysis in our support tickets that came free with Zendesk, and there's whatever Gmail is doing when it autocompletes my sentences. But I can't say that in a room full of people who told their boards we're "transforming the business through AI." So I said we have "distributed AI touchpoints across multiple vendors with no single point of failure." Which is technically true. We use a bunch of different services that all have AI features we mostly ignore. The CFO asked if we should "hedge our AI exposure." I have no idea what that means. Neither does he. What am I going to do: nothing. Because in three weeks, Anthropic will say something reassuring, the stocks will recover, and everyone will forget this happened. But I'll have documentation showing I recommended a "risk assessment" that mysteriously never got prioritized. The funniest part is that half these executives probably don't even know what Anthropic is. They just saw "AI" and "crash" in the same headline. We're all pretending. The whole industry is pretending. And articles like this just remind everyone how fragile the pretending is.