Tested: Microsoft Recall can still capture credit cards and passwords, a treasure trove for crooks

Recent tests by The Register reveal significant security vulnerabilities in Microsoft's AI-powered Recall feature on Copilot+ PCs, demonstrating its failure to reliably filter sensitive financial and personal data, including credit card numbers and passwords. Despite Microsoft's purported security enhancements and VBS enclave protection, Recall's captured data remains accessible via PIN and remotely, creating a substantial 'treasure trove' for potential attackers. This poses considerable data breach and privacy risks, challenging Microsoft's assurances and raising concerns for institutional investors regarding the security posture of new AI-integrated operating systems and the broader implications for user data protection.

Analysis

Recent testing of Microsoft's re-introduced Recall feature for Copilot+ PCs reveals persistent and significant security vulnerabilities, directly contradicting the company's security assurances. Despite the implementation of encryption and a Virtualization-based Security Enclave (VBS), the core functionality fails to reliably filter sensitive data; tests demonstrated the capture of credit card numbers, passwords, and Social Security numbers under various common scenarios. A critical flaw remains the accessibility of the entire screenshot database with only a user's PIN, a vulnerability that extends to remote access sessions. This creates a substantial data aggregation risk, described as a 'treasure trove for crooks'. The findings, which carry a 'strongly negative' sentiment score (-0.8) for Microsoft (MSFT), are amplified by concerns from cybersecurity firms like Huntress Security about potential VBS exploits and privacy advocates like Brave Software regarding risks to vulnerable users. While Microsoft positions Recall as a 'preview', its integration into the standard Windows setup process for new devices elevates the reputational risk and could negatively impact the adoption of the strategic Copilot+ PC platform.

Key Decisions for Investors

• Investors in Microsoft should monitor for any negative impact on Copilot+ PC sales, as persistent security concerns surrounding the flagship Recall feature could deter consumer and enterprise adoption.
• The identified privacy flaws and PIN-based access vulnerability expose Microsoft to heightened reputational and potential regulatory risk, warranting close observation of the company's official response and the timeliness of effective security patches.
• The challenges with Recall highlight execution risks in the broader 'AI-on-device' trend; this serves as a cautionary signal to scrutinize the security posture of all companies integrating generative AI deeply into consumer operating systems.
• Given the strongly negative sentiment and the fundamental nature of the security issues, traders may price in short-term headline risk for MSFT, although a material impact on the stock's long-term trajectory would likely require evidence of widespread exploits or a significant change in enterprise deployment plans.