When Microsoft announced its new AI features for AI PCs, I told you that Windows 11’s Recall is the feature I’ve always wanted from AI devices but that it’s also terrifying. Windows 11 Recall will let AI help you remember what you did on your computer and when it happened. It’s a feature we’ll need if we want helpful, personal AI assistants.
But Recall also has to be super secure, considering that the Copilot Plus PC is practically saving screenshots of almost everything you do. It turns out that’s not what’s happening. Hackers might be able to easily steal the databases of your Recall files once they get malware on your PC.
That’s why I’ll tell you to turn off Windows 11 Recall as soon as Microsoft forces it on you. In typical Microsoft fashion, Recall is optional only if you disable it from the Settings app. Initially, Microsoft will force it down your throat whether you want it or not.
The Verge’s Tom Warren posted on X the setup screens of Windows 11 Copilot Plus PCs. You can’t turn off Recall during the setup procedure. You’ll have to disable it after you’re done, assuming you remember to do it. Hopefully, this will be your first warning if you’re a Windows user.
It gets worse, however. Microsoft tries to assure Windows 11 users that Recall is secure in its documentation. Hackers can’t access the information in your screenshots because your device is protected. I’m sure Microsoft isn’t wrong here. But if Kevin Beaumont’s findings are accurate, Microsoft is not totally transparent either.
The cybersecurity expert and former Microsoft employee discovered that you could easily access a database containing information from Recall screenshots on a Windows 11 PC regardless of whether you have admin privileges. The admin would be the main user of the PC. Microsoft said that Recall data would be available only to that user on an AI PC.
But, as Beaumont points out, the database is accessible even if you’re not a user. If hackers manage to get malware installed on your PC, they might teach it to steal that database. They’ll then look at the database for login credentials. Microsoft did say that the Recall feature might record those while you type them in.
Recall will also take screenshots of your messaging apps that are in view when it’s supposed to take screenshots. You won’t know it happens. The texts it reads will be collected in that text-only database Beaumont described.
No amount of encryption, or locking your Windows 11 PC with a password, will protect your Recall files if someone successfully deploys malware on your device. The researcher also showed how quickly hackers can exfiltrate the Recall data from an infected PC before protections kick in.
This is a massive security issue that Microsoft will hopefully fix by the time Recall rolls out more widely (and forcefully) to Windows 11 Copilot Plus PCs.
Beaumont argues that the Recall feature in its entirety should not target most Windows 11 users, even if it were secure:
A lot of Windows users just want their PCs so they can play games, watch porn, and live their lives as human beings who make mistakes… that they don’t always want to remember, and the idea other people with access to the device could see a photographic memory is… very scary to a great many people on a deeply personal level. Windows is a personal experience. This shatters that belief.
I think they are probably going to set fire to the entire Copilot brand due to how poorly this has been implemented and rolled out. It’s an act of self-harm at Microsoft in the name of AI, and by proxy real customer harm.
Beaumont described how this Recall hack would work, though he did not provide all the specifics. “I am deliberately holding back technical details until Microsoft ship the feature as I want to give them time to do something,” he wrote in a blog post where he explains the security issues.
He also said that Microsoft should recall the Windows 11 Recall feature and rework it “to be the feature it deserves to be, delivered at a later date. “They also need to review the internal decision-making that led to this situation, as this kind of thing should not happen.”
If you’re about to get a new Windows 11 PC with support for Recall, you’ll want to disable the feature as soon as you finish setting up the computer.
