Security researcher exposes new Windows Recall flaw, but Microsoft says it's not a vulnerability

Windows Recall faces renewed security scrutiny

Windows Recall is under fire again. Security researcher Alexander Hagenah has released TotalRecall Reloaded, a tool that exposes what he believes are critical security and privacy risks in Microsoft's AI-powered feature designed for Copilot+ Windows PCs 1

1

. The feature, which captures screenshots every few seconds to create a searchable timeline of user activity recording, was delayed nearly a year after its original 2024 launch due to severe security flaws 3

3

.

Microsoft redesigned Recall with encryption, VBS Enclaves, and Windows Hello authentication to address initial concerns. But Hagenah's research suggests the security boundary ends too early in the data delivery chain 4

4

. While the vault storing Recall data remains "rock solid," the AIXHost.exe process that renders the timeline lacks the same protections 1

1

.

How the TotalRecall Reloaded tool works

The TotalRecall Reloaded tool operates by injecting code into AIXHost.exe without requiring admin privileges or kernel exploit techniques 2

2

. It waits silently in the background until a user authenticates with Windows Hello to access their Recall timeline. Once user authentication occurs, the tool can intercept and extract decrypted screenshots, OCR text, and metadata flowing through the AIXHost.exe process 1

1

.

Hagenah describes the vulnerability with a vivid analogy: "The vault door is titanium. The wall next to it is drywall" 4

4

. The fundamental problem isn't the encryption or the secure enclave—it's that decrypted content gets sent to an unprotected process for rendering. This creates precisely the scenario Microsoft's architecture was supposed to restrict: malware riding along with legitimate user access to steal data 4

4

.

The tool can access both new information being recorded and previously stored data once authentication happens. Some tasks, including grabbing the most recent screenshot and deleting the entire Recall database, can even be performed without Windows Hello authentication 1

1

.

Microsoft security response sparks debate

Hagenah responsibly disclosed his findings to Microsoft's Security Response Center on March 6, 2026. On April 3, Microsoft officially classified the issue as "not a vulnerability" 1

1

. David Weston, corporate vice president of Microsoft Security, stated that "the access patterns demonstrated are consistent with intended protections and existing controls, and do not represent a bypass of a security boundary or unauthorized access to data" 4

4

.

Microsoft points to timeout periods and anti-hammering protection as safeguards that limit the impact of malicious queries 2

2

. However, Hagenah argues these protections can be bypassed, and the company's stance raises questions about data access controls for features that capture extensive user activity 5

5

.

The University of Pennsylvania's Office of Information Security released a warning on April 14, 2025, stating that Recall "introduces substantial and unacceptable security, legality, and privacy challenges," urging administrators to disable the feature 3

3

.

What this means for users and the AI feature's future

The security vulnerability debate highlights a fundamental tension: making data ultra-convenient for users to access while simultaneously securing it against hackers proves extremely difficult 3

3

. Recall stores screenshots, emails, messages, web activity, browsing history, timestamps, and AI-generated context—building a detailed picture of how users interact with their devices 5

5

.

Anyone with access to a PC and the Windows Hello fallback PIN can potentially view this database. Even though Recall's content filters exclude sensitive financial information, the sheer amount of personal data it records creates significant privacy threat potential 1

1

. Malicious hackers have already written code to exploit Recall's memory and send screenshots to remote servers 3

3

.

Currently, fewer than 10% of Windows 11 PCs can run Recall, with the feature available only as an opt-in for Copilot+ PC users since April 2025 3

3

. Windows Insider program participants have had access for over a year. Microsoft's plans for wider availability remain unclear, with journalist Zac Bowden reporting in January 2026 that the company is "pulling back its Windows 11 AI push with a major Copilot and Recall rethink" 3

3

.

Some app developers are taking matters into their own hands. Signal Messenger forces Recall to ignore it by default, using a flag normally intended for different purposes 1

1

. The cybersecurity community continues watching whether Microsoft will address these concerns or if the feature's fundamental design makes adequate security impossible. For now, the gap between the secure vault and the vulnerable delivery mechanism remains a point of contention in the ongoing debate about AI features that monitor everything users do.