Microsoft Recall is capturing screenshots of sensitive information like credit card and social security numbers

WTF?! Microsoft recalled Recall because of privacy outrage, er, concerns. It promised to improve its AI-based Windows surveillance feature before release, providing privacy safeguards and a more secure experience. Now that it is here, users can assess how much Microsoft's promises are worth for themselves.

After multiple delays and afterthoughts, Microsoft is now bringing Recall to more systems and CPU architectures. The new feature takes screenshots of the desktop every few seconds, using the on-device large language model to scan, store, and process information. In theory, Recall should work as a fine-tuning machine for Copilot's GPT-4o AI model. However, the new technology is an absolute mess of privacy violations and security dangers.

Tom's Hardware tested the "improved" Recall feature and recommended that every Windows 11 user should disable the feature immediately. While Recall includes a filter designed to avoid capturing screenshots with sensitive information, it doesn't really work.

Despite activating the filter, Recall senselessly captured screens with credit card numbers, credentials, Social Security numbers, and other personal information. Recall saved everything it saw while using the Notepad text editor. The same thing happened while opening a PDF in the Edge browser and entering information in an HTML form asking for credit card details.

Recall's filter works as intended while visiting online web stores, taking screenshots only before or after the credit card form. The AI surveillance machine provides "full control" of the feature, meaning users can check which screenshots it saves and when.

However, the idea that Recall saves credit card details and other extremely sensitive information to feed AI model training tasks is frightening and unnecessary. At this point, every privacy-conscious customer should worry about what Microsoft has done to its traditionally user-centric Windows platform. There is no good reason for this to be an opt-out feature.

Tom's Hardware's Avram Piltch asked Microsoft about Recall's apparent inability to filter private information from its saved screenshots. The company reminded Piltch that Recall is a privacy-abiding feature, updated to detect sensitive information such as credit card details, passwords, and personal identification numbers. Microsoft developers are still improving the feature. It urges concerned users to help with the development by sharing their experience through the Feedback Hub.