{"id":18356,"date":"2026-02-24T13:30:48","date_gmt":"2026-02-24T06:30:48","guid":{"rendered":"https:\/\/it-jkt.telkomuniversity.ac.id\/?p=18356"},"modified":"2026-02-25T08:47:53","modified_gmt":"2026-02-25T01:47:53","slug":"bug-microsoft-365-copilot-mengekspos-email-confidential","status":"publish","type":"post","link":"https:\/\/it-jkt.telkomuniversity.ac.id\/id\/bug-microsoft-365-copilot-mengekspos-email-confidential\/","title":{"rendered":"Bug Microsoft 365 Copilot Mengekspos Email \u201cConfidential\u201d"},"content":{"rendered":"<div class=\"wpb-content-wrapper\"><div class=\"vc_row wpb_row vc_row-fluid\"><div class=\"wpb_column vc_column_container vc_col-sm-12\"><div class=\"vc_column-inner\"><div class=\"wpb_wrapper\"><h1 style=\"text-align: center\" class=\"vc_custom_heading vc_do_custom_heading\" >\ud83d\udea8New Cybersecurity Advisory\ud83d\udea8<br \/>\nBug pada Microsoft 365 Copilot Berpotensi Mengekspos Email Berlabel \u201cConfidential\u201d (bypass DLP)<\/h1><\/div><\/div><\/div><\/div><div class=\"vc_row wpb_row vc_row-fluid\"><div class=\"wpb_column vc_column_container vc_col-sm-12\"><div class=\"vc_column-inner\"><div class=\"wpb_wrapper\">\n\t<div class=\"wpb_text_column wpb_content_element\" >\n\t\t<div class=\"wpb_wrapper\">\n\t\t\t<p>Microsoft mengonfirmasi adanya bug pada fitur <strong>Microsoft 365 Copilot Chat (work tab)<\/strong> yang berpotensi merangkum email dengan label sensitivitas \u201cConfidential\u201d. Kondisi ini menyebabkan kebijakan <em>Data Loss Prevention (DLP)<\/em> tidak berjalan secara optimal, sehingga informasi sensitif berisiko terekspos melalui hasil ringkasan yang dihasilkan Copilot.<\/p>\n<p>Kerentanan ini dilacak dengan ID <strong>CW1226324<\/strong>, terdeteksi pada 21 Januari 2026. Upaya perbaikan telah dilakukan sejak Februari 2026 dan hingga 18 Februari 2026 statusnya masih dalam pemantauan. Tingkat keparahan insiden ini dikategorikan sebagai <strong>High<\/strong>.<\/p>\n\n\t\t<\/div>\n\t<\/div>\n<\/div><\/div><\/div><\/div><div class=\"vc_row wpb_row vc_row-fluid\"><div class=\"wpb_column vc_column_container vc_col-sm-12\"><div class=\"vc_column-inner\"><div class=\"wpb_wrapper\">\n\t<div class=\"wpb_text_column wpb_content_element\" >\n\t\t<div class=\"wpb_wrapper\">\n\t\t\t<p><strong>\ud83c\udfaf Metode Serangan<\/strong><\/p>\n<p>Permasalahan ini terjadi akibat isu pada logika pemrosesan sistem, di mana Copilot Chat masih dapat membaca email pada folder <strong>Sent Items<\/strong> dan <strong>Drafts<\/strong>, meskipun pesan tersebut telah diberi <em>sensitivity label<\/em> atau berada dalam kebijakan DLP.<\/p>\n<p>Akibatnya, Copilot tetap dapat menghasilkan ringkasan yang memuat isi maupun metadata email, sehingga secara tidak langsung melewati kontrol perlindungan data yang telah diterapkan.<\/p>\n\n\t\t<\/div>\n\t<\/div>\n<\/div><\/div><\/div><\/div><div class=\"vc_row wpb_row vc_row-fluid\"><div class=\"wpb_column vc_column_container vc_col-sm-12\"><div class=\"vc_column-inner\"><div class=\"wpb_wrapper\">\n\t<div class=\"wpb_text_column wpb_content_element\" >\n\t\t<div class=\"wpb_wrapper\">\n\t\t\t<p><strong>\ud83d\udda5 Sistem yang Berpotensi Terdampak<\/strong><\/p>\n<p>Insiden ini berdampak pada tenant <strong>Microsoft 365 bisnis<\/strong> yang mengaktifkan fitur <strong>Microsoft 365 Copilot Chat (work tab)<\/strong> dan terintegrasi dengan Outlook serta Exchange Online, khususnya email dalam folder Sent Items dan Drafts yang telah diberi label sensitivitas dan berada di bawah kebijakan DLP.<\/p>\n\n\t\t<\/div>\n\t<\/div>\n<\/div><\/div><\/div><\/div><div class=\"vc_row wpb_row vc_row-fluid\"><div class=\"wpb_column vc_column_container vc_col-sm-12\"><div class=\"vc_column-inner\"><div class=\"wpb_wrapper\">\n\t<div class=\"wpb_text_column wpb_content_element\" >\n\t\t<div class=\"wpb_wrapper\">\n\t\t\t<p><strong>\ud83d\udee1 Rekomendasi Mitigasi<\/strong><\/p>\n<p>Beberapa langkah mitigasi yang disarankan:<\/p>\n<ol>\n<li>a) Menonaktifkan sementara Microsoft 365 Copilot Chat (work tab) atau mencabut lisensi\/service plan Copilot bagi pengguna atau grup berisiko tinggi hingga Microsoft mengonfirmasi perbaikan telah diterapkan sepenuhnya.<\/li>\n<li>b) Membatasi akses Copilot ke Exchange Online melalui kebijakan <em>Conditional Access<\/em> untuk grup tertentu, serta menghindari penggunaan fitur ringkasan Copilot pada konten berlabel \u201cConfidential\u201d.<\/li>\n<li>c) Menerapkan label dengan enkripsi (misalnya <em>Encrypt-Only<\/em> atau <em>Do Not Forward<\/em>) pada pesan sensitif agar tidak dapat diproses oleh Copilot.<\/li>\n<li>d) Melakukan pemantauan melalui Microsoft Purview atau Unified Audit Log terhadap aktivitas Copilot\/Graph yang berkaitan dengan mailbox, serta mengikuti pembaruan resmi melalui Message Center dengan ID CW1226324.<\/li>\n<\/ol>\n\n\t\t<\/div>\n\t<\/div>\n<\/div><\/div><\/div><\/div><div class=\"vc_row wpb_row vc_row-fluid\"><div class=\"wpb_column vc_column_container vc_col-sm-12\"><div class=\"vc_column-inner\"><div class=\"wpb_wrapper\">\n\t<div class=\"wpb_text_column wpb_content_element\" >\n\t\t<div class=\"wpb_wrapper\">\n\t\t\t<p>Referensi:<br \/>\n<a href=\"https:\/\/www.bleepingcomputer.com\/news\/microsoft\/microsoft-says-bug-causes-copilot-to-summarize-confidential-emails\/\">https:\/\/www.bleepingcomputer.com\/news\/microsoft\/microsoft-says-bug-causes-copilot-to-summarize-confidential-emails\/<\/a><\/p>\n\n\t\t<\/div>\n\t<\/div>\n<\/div><\/div><\/div><\/div>\n<\/div>","protected":false},"excerpt":{"rendered":"\ud83d\udea8New Cybersecurity Advisory\ud83d\udea8 Bug pada Microsoft 365 Copilot Berpotensi Mengekspos Email Berlabel \u201cConfidential\u201d (bypass DLP) Microsoft mengonfirmasi adanya bug pada fitur Microsoft 365 Copilot Chat (work tab) yang berpotensi merangkum email dengan label sensitivitas \u201cConfidential\u201d. Kondisi ini menyebabkan kebijakan Data Loss Prevention (DLP) tidak berjalan secara optimal, sehingga informasi sensitif berisiko terekspos melalui hasil ringkasan [...]","protected":false},"author":5,"featured_media":18357,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"wds_primary_category":0,"footnotes":""},"categories":[80,86],"tags":[297,299,298],"class_list":["post-18356","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-artikel","category-microsoft","tag-bug-microsoft-365-copilot","tag-bypass-dlp","tag-email-confidential"],"blocksy_meta":{"styles_descriptor":{"styles":{"desktop":"","tablet":"","mobile":""},"google_fonts":[],"version":7}},"gutentor_comment":0,"rttpg_featured_image_url":{"full":["https:\/\/it-jkt.telkomuniversity.ac.id\/wp-content\/uploads\/2026\/02\/Bug-pada-Microsoft-365-Copilot-Berpotensi-Mengekspos-Email-Berlabel-Confidential-bypass-DLP.webp",1920,1080,false],"landscape":["https:\/\/it-jkt.telkomuniversity.ac.id\/wp-content\/uploads\/2026\/02\/Bug-pada-Microsoft-365-Copilot-Berpotensi-Mengekspos-Email-Berlabel-Confidential-bypass-DLP.webp",1920,1080,false],"portraits":["https:\/\/it-jkt.telkomuniversity.ac.id\/wp-content\/uploads\/2026\/02\/Bug-pada-Microsoft-365-Copilot-Berpotensi-Mengekspos-Email-Berlabel-Confidential-bypass-DLP.webp",1920,1080,false],"thumbnail":["https:\/\/it-jkt.telkomuniversity.ac.id\/wp-content\/uploads\/2026\/02\/Bug-pada-Microsoft-365-Copilot-Berpotensi-Mengekspos-Email-Berlabel-Confidential-bypass-DLP-150x150.webp",150,150,true],"medium":["https:\/\/it-jkt.telkomuniversity.ac.id\/wp-content\/uploads\/2026\/02\/Bug-pada-Microsoft-365-Copilot-Berpotensi-Mengekspos-Email-Berlabel-Confidential-bypass-DLP-300x169.webp",300,169,true],"large":["https:\/\/it-jkt.telkomuniversity.ac.id\/wp-content\/uploads\/2026\/02\/Bug-pada-Microsoft-365-Copilot-Berpotensi-Mengekspos-Email-Berlabel-Confidential-bypass-DLP-1024x576.webp",1024,576,true],"1536x1536":["https:\/\/it-jkt.telkomuniversity.ac.id\/wp-content\/uploads\/2026\/02\/Bug-pada-Microsoft-365-Copilot-Berpotensi-Mengekspos-Email-Berlabel-Confidential-bypass-DLP-1536x864.webp",1536,864,true],"2048x2048":["https:\/\/it-jkt.telkomuniversity.ac.id\/wp-content\/uploads\/2026\/02\/Bug-pada-Microsoft-365-Copilot-Berpotensi-Mengekspos-Email-Berlabel-Confidential-bypass-DLP.webp",1920,1080,false],"trp-custom-language-flag":["https:\/\/it-jkt.telkomuniversity.ac.id\/wp-content\/uploads\/2026\/02\/Bug-pada-Microsoft-365-Copilot-Berpotensi-Mengekspos-Email-Berlabel-Confidential-bypass-DLP.webp",18,10,false]},"rttpg_author":{"display_name":"dianaape@telkomuniversity.ac.id","author_link":"https:\/\/it-jkt.telkomuniversity.ac.id\/id\/author\/dianaapetelkomuniversity-ac-id\/"},"rttpg_comment":0,"rttpg_category":"<a href=\"https:\/\/it-jkt.telkomuniversity.ac.id\/id\/category\/artikel\/\" rel=\"category tag\">Artikel<\/a> <a href=\"https:\/\/it-jkt.telkomuniversity.ac.id\/id\/category\/panduan\/microsoft\/\" rel=\"category tag\">Microsoft<\/a>","rttpg_excerpt":null,"_links":{"self":[{"href":"https:\/\/it-jkt.telkomuniversity.ac.id\/id\/wp-json\/wp\/v2\/posts\/18356","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/it-jkt.telkomuniversity.ac.id\/id\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/it-jkt.telkomuniversity.ac.id\/id\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/it-jkt.telkomuniversity.ac.id\/id\/wp-json\/wp\/v2\/users\/5"}],"replies":[{"embeddable":true,"href":"https:\/\/it-jkt.telkomuniversity.ac.id\/id\/wp-json\/wp\/v2\/comments?post=18356"}],"version-history":[{"count":4,"href":"https:\/\/it-jkt.telkomuniversity.ac.id\/id\/wp-json\/wp\/v2\/posts\/18356\/revisions"}],"predecessor-version":[{"id":18362,"href":"https:\/\/it-jkt.telkomuniversity.ac.id\/id\/wp-json\/wp\/v2\/posts\/18356\/revisions\/18362"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/it-jkt.telkomuniversity.ac.id\/id\/wp-json\/wp\/v2\/media\/18357"}],"wp:attachment":[{"href":"https:\/\/it-jkt.telkomuniversity.ac.id\/id\/wp-json\/wp\/v2\/media?parent=18356"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/it-jkt.telkomuniversity.ac.id\/id\/wp-json\/wp\/v2\/categories?post=18356"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/it-jkt.telkomuniversity.ac.id\/id\/wp-json\/wp\/v2\/tags?post=18356"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}