# @pcaversaccio: Windows Notepad's Copilot integration risks leaking credentials

Source: https://x.com/pcaversaccio/status/1929506548591493480
Kiwi News: https://news.kiwistand.com/stories/pcaversaccio-Windows-Notepads-Copilot-integration-risks-leaking-credentials?index=0x683dce1287072e6f0466de183e62b0052d865d8e1bde9d40f877ee267e521b9b9a20372c
Submitted by tim on 2025-06-02 UTC, 4 upvotes, 0 comments

## Summary

pcaversaccio warns that Windows Notepad's Copilot integration risks leaking sensitive data from plaintext files, because opening a .txt file could send its contents to Microsoft's servers. Microsoft claims this happens only when Copilot features are actively used, a claim pcaversaccio says users shouldn't trust. Many people store passwords and 2FA backup codes in .txt files, which 2FA providers themselves often offer as downloads. pcaversaccio recommends disabling the feature or Copilot system-wide, and using an app such as Notepad++, which is described as local and not phoning home.

## Article

Let's be real, a ton of people (yes, even probably you reading this) store pws, 2FA backup codes, and other sensitive info in `.txt` files. Even the 2FA providers themselves often give you those backup codes as `.txt` downloads. It's shit, but it's common. Obviously don't use `.txt` files to store any sensitive data, but let's address the major issue now: on Windows, Notepad is getting Copilot integration (sounds cool for many, but it's fucked!). That means if you open one of those `.txt` credential files, you're potentially leaking sensitive data to Microsoft's servers (I know you already leaked your dick/feet pics via the cloud sync feature of images but you don't care about those that much). They claim it only happens if you actively use Copilot features; but dude, who actually trusts that lol?

If you run on Windows, disable this feature (and the spellchecking as well) - or even better, disable Copilot system-wide - and set something like Notepad++ as the default app for `.txt` files. It's lightweight, local, and not phoning home. Until you're using proper encryption or a pw manager, at least make sure your plaintext isn't being silently beamed to the cloud. And if you feel Cypherpunk enough use Qubes OS instead :)