Microsoft’s AI-Powered Recall Feature Still Saves Snapshots of Sensitive Information: Report

Microsoft finally rolled out its artificial intelligence (AI)-powered Recall feature with the Windows 11 Insider Preview update last month. But contrary to Microsoft's claims that the updated version does not store sensitive information such as credit cards or passwords, a new report suggests this security measure seldom works. Multiple instances of the AI feature saving snapshots of credit card details and social security numbers were reported, even with the Filter sensitive information setting enabled.

Tom's Hardware detailed the experience with the updated version of Microsoft's Recall feature in a report. The publication highlights that they encountered an instance of the AI feature capturing a screenshot of sensitive information when they entered credit card details and random login credentials in the Notepad app. In this case, the words “Capital One Visa” were written down right next to the information. The report clarifies that this occurred when using fake as well as legitimate credit card details.

On another occasion, the publication filled out a loan application PDF on the Microsoft Edge browser. This included contact details, date of birth, and social security number. Yet another instance of Recall not filtering out confidential information transpired when an HTML page with a web form was created that required users to “enter [their] credit card number below”. It included text fields for entering the credit card type, its number, CVC, and expiration date.

The report claims Microsoft's AI software captured a snapshot of these details as well.

However, two instances of Recall's security filter fulfilling its purpose were also recorded. This was reported on the online payment pages of two platforms — Pimoroni and Adafruit. The AI feature captured snapshots of the screen before and after filling in the details, but not during.

First introduced at the Microsoft Surface and AI event in May, Recall was pulled back from Windows test builds a month later due to privacy and security concerns. The Redmond-based technology giant halted its rollout to Windows Insiders. Last month, it was rolled out Copilot+ PCs with the Windows 11 Insider Preview Build 26120.2415 (KB5046723) to the Dev Channel. Microsoft emphasised that snapshots remain on-device and are not sent to Microsoft or third-party servers, or used for training AI models or any other features.