Home
Ai
Ai News
Microsoft's Recall Feature Faces Criticism After TotalRecall Reloaded Tool Regains Access to Data

Microsoft's Recall Feature Faces Criticism After TotalRecall Reloaded Tool Regains Access to Data

Hagenah said he shared his findings with Microsoft in March, along with the necessary technical details and code.

Written by Sucharita Ganguly, Edited by David Delima | Updated: 16 April 2026 15:59 IST

Microsoft's Recall Feature Faces Criticism After TotalRecall Reloaded Tool Regains Access to Data

Photo Credit: Microsoft

Microsoft had reworked Recall after facing criticism earlier

Click Here to Add Gadgets360 As A Trusted Source

Highlights

Research highlights gaps in Recall’s data access controls
Researcher says Recall data can be accessed after login
Microsoft says Recall behaviour aligns with system design

TotalRecall Reloaded, a tool developed by cybersecurity researcher Alexander Hagenah, has raised fresh concerns about Microsoft's Windows Recall feature and how it handles sensitive user data. The research points to potential issues in how information is accessed after authentication, even though Microsoft had redesigned Recall with stronger protections. The company reportedly views the behaviour as part of its existing system design, but the findings highlight ongoing concerns about whether features that record user activity can remain both useful and secure.

TotalRecall Reloaded Highlights Ongoing Windows Recall Security Concerns

The Recall tool is built to pull data from Recall, an AI feature that takes regular snapshots of what appears on your screen so you can search through your past activity. Hagenah said his updated version can quietly run in the background and access that data once a user logs in through Windows Hello.

Microsoft Discussion

Explore More...

Microsoft had reworked Recall after facing criticism earlier, adding stronger protections like encryption, secure enclaves and biometric authentication. The company had said these changes would stop malicious software from taking advantage of a user's login to access stored data.

Signal’s New Update Will Not Let Microsoft Recall

However, Hagenah explains that the protection does not fully work as intended. He said the system's secure storage is strong, but the boundary that controls how data is accessed breaks down too early. According to him, the tool can effectively follow a user's authentication process and then retrieve stored information.

The data Recall stores go beyond simple screenshots. It can include on-screen text, messages, emails, documents, browsing activity, timestamps, and AI-generated context, building a detailed picture of how a user interacts with their device.

Hagenah said he shared his findings with Microsoft in March 2026, along with the necessary technical details and code. He claims the company reviewed the report but did not consider it a security issue, stating that the behaviour aligns with how the system is meant to work and does not break any security boundaries.

Microsoft's Contentious Recall Feature is Rolling Out to Copilot+ PCs

Microsoft also said that measures like time limits and protections against repeated access help reduce the risk. Hagenah, however, disagreed and argued that these safeguards can be bypassed.

The Verge reported that the issue may stem from the way Recall delivers decrypted data to other processes after authentication. While the storage system itself remains secure, the method used to present that data could expose it to misuse.

Despite the concerns, Hagenah acknowledged that several parts of Recall's redesigned security, including its encryption and authentication model, are robust, according to the aforementioned The Verge report. He suggested that further improvements are needed in how data is handled after it leaves the secure environment.

Comments

Get your daily dose of tech news, reviews, and insights, in under 80 characters on Gadgets 360 Turbo. Connect with fellow tech lovers on our Forum. Follow us on X, Facebook, WhatsApp, Threads and Google News for instant updates. Catch all the action on our YouTube channel.

Further reading: Microsoft, Recall, Windows, AI, Artificial Intelligence, Cybersecurity

Sucharita Ganguly

Email Sucharita Ganguly

Sucharita is a writer with Gadgets 360 and is mostly found playing with her cat in her free time. She has previously worked at breaking news desks across organizations. Powered by coffee, The Beatles, Bowie, and her newfound love for BTS, she aims to work towards contributing to a better media environment for women and queer folk. More