Copilot Contractors Can See Users’ Private Photos and Prompts

Human contractors hired to help evaluate Microsoft Copilot have reportedly been given access to users’ uploaded photos, editing requests and the images generated by the AI system. A report by 404 Media, cited by multiple technology outlets, says reviewers are shown the original image, the user’s prompt and two possible AI-generated edits so they can assess the quality of Copilot’s output.

According to the reports, the contractors are asked to determine which generated image better follows the user’s instructions and preserves important aspects of the original photograph. Their assessments focus on technical quality, such as whether the requested changes were correctly made, rather than primarily determining whether the content itself is appropriate. The reviewers can reportedly see faces in uploaded photographs without them being automatically censored.

The discovery has raised concerns because some of the material reportedly presented to reviewers involved highly sensitive or sexualised image-editing requests. Contractors told 404 Media that they encountered requests involving people’s bodies and images that appeared potentially non-consensual. Reports also described examples involving young people and other disturbing content. These accounts have intensified questions about how personal images are handled when users submit them to AI services.

Microsoft has not said that every Copilot conversation or image is routinely reviewed by humans. However, the company’s broader Copilot strategy increasingly relies on AI systems being evaluated and improved through human feedback. Microsoft recently announced new Copilot capabilities, including Autopilot, a persistent AI agent designed to continue working on tasks even when the user is not actively interacting with it.

The situation highlights a wider privacy issue surrounding generative AI: users may assume that an interaction is exclusively between themselves and an automated system, while some data can potentially enter human review or quality-assurance processes depending on the service and its terms. As AI companies expand image generation, editing and autonomous-agent features, transparency about when humans can access user content is likely to remain an important part of the privacy debate.