Security Researcher Calls Windows 11 AI 'Recall' Screenshotting Feature a Disaster [Updated]

Last month, Microsoft announced the upcoming launch of Copilot+ Windows PCs with integrated AI hardware and software. One feature that Microsoft touted was Recall, a tool that's designed to take regular snapshots of PC content to help users find anything they've seen or done on their machine.


As it turns out, Recall might be a security nightmare for Windows users. Security expert Kevin Beaumont recently said (via The Verge) that he was able to automate a program that provides plain text data of everything a user has viewed, despite Microsoft's claims that Recall information cannot be exfiltrated remotely.

Beaumont claims that Recall is "essentially an infostealer" that's included in Windows by default, and that it will "set cybersecurity back a decade by empowering cybercriminals." With Recall, hackers are able to scrape "everything you've ever looked at within seconds," and users should prepare for "AI powered super breaches."

Microsoft describes Recall as a feature that lets you "search across time to find the content you need." Powered by AI, Recall takes snapshots every five seconds when content on the screen is different from the prior snapshot and stores the snapshots in a timeline, with AI software using OCR to make the text in the snapshots searchable. Microsoft says that snapshots are locally stored and are analyzed on-device, which should make them secure, but the OCR data is stored in an SQLite database that could be accessed by hackers who infiltrate a PC using malware.

According to Beaumont, infostealer trojans are able to be "easily modified to support Recall" and data from the feature can be accessed remotely. Microsoft "tried to do a bunch of things" to improve security, but ultimately, "none of it actually works properly in the real world." The database that is theoretically accessible by malicious actors contains everything a user has seen such as text messages and passwords, every user interaction, and all websites visited (with the exception of Microsoft Edge in Private Mode).

Beaumont has not shared full technical details on how he automated exfiltration of the Recall database, and is holding until Recall is shipped because he wants to give Microsoft "time to do something." Beaumont recommends that Microsoft pull the feature for the time being.

Copilot+ PCs with Recall are set to launch on June 18. As of now, Recall is turned on by default, though users can optionally disable it.

Update: Given the response to Recall, Microsoft has decided to make it an opt-in feature rather than an opt-out feature. It will no longer be on by default, and there will be an option to opt in or opt out when setting up a Copilot+ PC. Windows Hello will also be required to turn on Recall for an extra layer of authentication. Windows Hello requires a face scan, fingerprint, or PIN to access a machine. Proof of presence will be required as well, so a screenshot timeline won't be accessible without authentication.

To address concerns about the accessibility of the database that Recall creates, Microsoft is adding additional layers of protection linked to authentication, and the search index database has been encrypted.

Popular Stories

iPhone Air

Report: 'Virtually No Demand' for iPhone Air

Wednesday October 22, 2025 3:22 am PDT by
Apple is "drastically" cutting production of the iPhone Air and shifting focus toward the iPhone 17 and iPhone 17 Pro models, Nikkei Asia reports. The business publication claims to have learned of a major cut to iPhone Air production motivated by weaker-than-expected consumer interest, nearly to "end of production levels." Despite early reports of the iPhone Air selling out within hours of...
sam sung auction

Former Apple Employee Sam Sung Changed His Name to Avoid Attention

Wednesday October 22, 2025 4:44 pm PDT by
Back in 2012, an Apple retail employee named Sam Sung went viral because his name is similar to Samsung, one of Apple's main competitors. In a recent interview with Business Insider, he detailed that period in his life, how Apple responded, and he explained why he ultimately changed his name. Someone posted an image of Sung's Apple business card on Reddit in 2012, and it spread rapidly....
iOS 26

iOS 26.1 Coming Soon With These 8 New Features for Your iPhone

Wednesday October 22, 2025 6:15 am PDT by
The upcoming iOS 26.1 update includes a handful of new features and changes for iPhones, including a toggle for changing the appearance of the Liquid Glass design, "slide to stop" for alarms in the Clock app, and more. iOS 26.1 is currently in beta testing. The update will likely be released in the first half of November, and it is compatible with the iPhone 11 series and newer, but some...
cadillac lyric infotainment

GM to Remove CarPlay from All Future Vehicles, Including Gas Cars [Updated]

Wednesday October 22, 2025 11:34 am PDT by
General Motors began phasing out support for CarPlay in its electric vehicles back in 2023, leading to complaints from iPhone users, but the company has no plans to back down. In fact, GM is going further and plans to remove CarPlay from all future gas vehicles, too. In an interview with The Verge, GM CEO Mary Barra said that the company opted to prioritize its platform for EVs, but the...
All Screen iPhone 2027 Feature 1

Apple's Plan to Launch Three New iPhone Designs Allegedly Revealed

Wednesday October 22, 2025 6:24 am PDT by
Apple plans to launch a new type of iPhone every year for the foreseeable future, according to an Asia-based source. The detailed information was shared by the account "yeux1122" in a blog post on the Korean platform Naver, citing domestic trend and component research companies. Corroborating other reports, Apple will apparently launch its first foldable iPhone in 2026, featuring a...
All Screen iPhone 2027 Feature 1

Report: Apple to Skip 'iPhone 19' Name for 'iPhone 20'

Thursday October 23, 2025 4:28 am PDT by
Apple's new iPhone lineup launched in the fall of 2027 will be called the "iPhone 20" models, rather than the "iPhone 19," according to research firm Omdia. Speaking at a conference in Seoul (via ETNews), Omdia Chief Researcher Heo Moo-yeol corroborated rumors that Apple plans to move the launch of its standard iPhone to the first half of the year and provided some additional clarity about...
maxresdefault

Apple's iPhone Air Experiment Fails as Supply Chain Cuts Production by 80%

Wednesday October 22, 2025 10:48 am PDT by
iPhone Air demand failed to meet Apple's expectations and the company's supply chain is scaling back shipments and production, reports Apple analyst Ming-Chi Kuo. Subscribe to the MacRumors YouTube channel for more videos. Suppliers are expected to reduce capacity by more than 80 percent between now and the first quarter of 2026, and some components with longer lead times will be discontinued ...
iOS 26 Battery Glass Feature

iOS 26.1 Beta Liquid Glass Battery Drain Test: Tinted vs Clear Mode

Friday October 24, 2025 2:30 pm PDT by
In the fourth iOS 26.1 beta, Apple added a "Tinted" option that reduces the translucency of Liquid Glass for those who prefer a more opaque look. I saw some comments wondering whether the setting might preserve battery life, so I thought I'd do some testing. Test Settings I did four separate tests using the iPhone 17 Pro Max, and I kept the parameters as similar as possible. Here are the...
trump white house ballroom

Apple Donating to Trump's $350M White House Ballroom Project

Thursday October 23, 2025 3:55 pm PDT by
Apple is one of several tech companies that will contribute to the construction of U.S. President Donald Trump's 90,000-square-foot ballroom, reports CNN. Construction began on the ballroom this week, and the White House's east wing was torn down. Trump claims that the ballroom will cost $350 million, and that it will be privately funded through donations. The cost has already increased $150 ...
apple wallet drivers license feature iPhone 15 pro

iPhone Driver's License Feature in Apple Wallet App Launches in Another U.S. State

Thursday October 23, 2025 7:44 am PDT by
In select U.S. states, residents can add their driver's license or state ID to the Wallet app on the iPhone and Apple Watch, providing a convenient and contactless way to display proof of identity or age at select airports and businesses, and in select apps. Starting today, the feature is available to residents of West Virginia. To set it up, open the Wallet app and tap on the plus sign in...

Top Rated Comments

vertsix Avatar
18 months ago
I hate all this AI ****.

There, I said it.
Score: 93 Votes (Like | Disagree)
EightBitJoe Avatar
18 months ago
Hey, what could be the harm, right? It's Microsoft! I trust them.

Them. Them.

I. I. I trust. Trrrrrrrrr.

?SYNTAX ERROR IN LINE 39737

GENERAL FAILURE READING DRIVE C. ABORT, RETRY, FAIL?

Thank you for using BillGPT. Goodbye.
Score: 52 Votes (Like | Disagree)
StralyanPithecus Avatar
18 months ago

I hate all this AI ****.
Another tool developed to spy on users.
Score: 31 Votes (Like | Disagree)
Delivered Avatar
18 months ago

imagine if Apple did this
As someone who loves apple products and uses a lot of them, I am a harsh critic of apple because I want their stuff be great for me to keep using it. When Apple anounced the photo scanning locally on device the techsphere nearly brought the internet down on apple.

Microsoft does this and because they slapped AI/chatgpt/copiolot we all just What say “I hope they nail the security“ This is a flaw at the core. It takes pictures of the passwords as you enter them. That’s so lazy it’s unreal. Microsoft and google wasted no time throwing off the “we care about privacy” hats and double way down on ”feed us data for AI”.

Good luck “turning it off” Microsoft‘s privacy settings are AWFUL. I tried going through it I have no idea and the next update will probably just switch it back on, change a setting w/e. It’s ridiculous.
Score: 28 Votes (Like | Disagree)
DHagan4755 Avatar
18 months ago

As of now, Recall is turned on by default, though users can optionally disable it.
Is it really off when it's disabled?
Score: 25 Votes (Like | Disagree)
JosephAW Avatar
18 months ago
It’s just a fancy key-logger. o_O
Score: 22 Votes (Like | Disagree)