Contractors evaluating Microsoft Copilot’s image edits can see users’ original photos and prompts alongside the AI’s output, 404 Media reports. The material reportedly includes requests to sexualize pictures of identifiable people, putting a human audience behind exchanges users may treat as private.
According to Joseph Cox’s September 28 report, reviewers receive an uploaded picture, the user’s editing instructions and two generated alternatives. They judge which edit follows the request better, preserves details that should stay unchanged and looks more convincing. That means the original photo itself can reach a reviewer, even when the task is simply to compare generated results.
“Faces are always uncensored, and many of the prompts are sexual in nature and dubiously consensual”
An anonymous Copilot reviewer, speaking to 404 Media
That is one reviewer’s account, not a measurement of how often identifiable or sexual material appears. But it describes a concrete privacy exposure: someone evaluating an edit may recognize the person in the source image. The report does not establish whether the people pictured consented to the uploads.
Cox says he examined internal instructions, real prompts and pictures, and contractor message-board discussions. The underlying records were not published, and Frontier Models has not independently inspected them. The report also leaves unresolved which Copilot app or service supplied the images, the users’ account types and when the submissions were made.
Microsoft told 404 Media that it uses customer data as described in its terms, including for product improvement and enforcing its code of conduct. That response did not deny contractor access, but it supplied no details about which submissions reach reviewers or how identifying information is handled.
What the privacy promises cover
Microsoft’s current personal-Copilot documentation says prompts, responses and files are not used to train foundation models, the underlying AI systems. That commitment does not settle whether people can examine content for other purposes.
Excluding content from foundation-model training does not guarantee that no person will evaluate it. Microsoft documents separate protections for personal Copilot, Microsoft 365 home apps and work or school accounts, but none identifies which supplied the reported queue. Its current personal-app controls describe memory management and history deletion without documenting a way to stop human review or withdraw material already assigned to reviewers.
Microsoft’s Privacy Statement describes manual review of some AI results. Its current Copilot transparency note also describes human annotators in evaluation processes. However, that note discusses synthetic conversations and recruited participants too. Neither document establishes that ordinary users’ uploads enter the particular workflow 404 describes.
The Copilot name alone cannot tell readers whether their account is affected. Personal Copilot’s terms exclude organizational accounts. Copilot within Microsoft 365 home apps has separate documentation, while work and school accounts receive enterprise data protection and administrator-accessible logging. All three exclude foundation-model training in the consulted documents; none connects its users to the reported image-review queue.
For people seeking a way to prevent contractor review, the published answer is incomplete. Microsoft’s current personal-app controls identify no setting that disables it. Users can delete conversations, but the documentation does not explain whether deletion withdraws queued review tasks or associated copies and annotations. This does not prove an additional control is absent from the product; it means the documented controls offer no such assurance.
The people receiving the pictures
The reviewers’ job also matters. According to 404, these contractors were assessing output quality, rather than being hired to moderate offensive material. Forum posts described sexualized editing requests and pro-anorexia content. One contractor reported unexpectedly receiving eight upskirt photos and asked for an unsafe-content flag.
That complaint establishes unexpected exposure in at least one task, not the warning or support arrangements across the workforce. The report does not comprehensively document whether reviewers could stop disturbing tasks, how compensation worked or what wellbeing support was available.
We would not treat a “not used for training” promise as sufficient reassurance before uploading a photo whose privacy depends on nobody else seeing it. The specific answer Microsoft still owes users is which submissions can reach a person, what that person can see and whether the user can prevent that access before sending the image.