News

Microsoft Bringing AI-Powered Copilot to OneNote App

• By Kurt Mackie
• 04/07/2023

Microsoft indicated this week that Microsoft 365 Copilot will be coming to its OneNote note-taking application.

Microsoft 365 Copilot is an artificial intelligence (AI)-enhanced chat-based search capability that returns answers in "natural language" form. It was introduced last month, and was made available for limited private testing. It uses OpenAI's latest GPT-4 large language model, plus information from the Microsoft Graph API, which has hooks into Microsoft 365 organizational data.

The coming addition of Microsoft 365 Copilot into OneNote promises to help users better formulate their plans and ideas. It uses a person's notes to that end, the announcement indicated:  

As your notetaking partner, Copilot uses your prompts to draft plans, generate ideas, create lists, organize information, and more. Copilot can transform existing text by summarizing, rewriting, formatting, and adding visual context.

While Microsoft 365 Copilot may tap organizational data to produce such content for OneNote users, Microsoft argues that organizations have already granted such access rights via the Microsoft 365 policies they use.

"Copilot automatically inherits your organization’s security, compliance, and privacy policies for Microsoft 365," the announcement explained. Microsoft also assured that it doesn't train Copilot on Microsoft 365 tenancy data.

Microsoft previously noted that Microsoft 365 Copilot can be "usefully wrong." Other observers sometimes describe this AI phenomenon as "hallucinating" or making up information in responses. With the coming OneNote integration of Copilot, Microsoft suggested that it has designed the interface to stress human agency. These interface changes to OneNote will include "noting limitations, providing links to sources, and prompting users to review, fact-check, and fine-tune content based on their own knowledge and judgment."

Exactly when OneNote users may see the Copilot integration wasn't described, although Microsoft previously had described Microsoft 365 Copilot as getting rolled out "in the months ahead." Microsoft has been adding Copilot across Office and other products, including Azure, Bing, Microsoft Edge, Dynamics 365 and Viva Sales.

In other OneNote news, it seems cybercriminals now like to use OneNote attachments in e-mails to deliver malware. This attack method was described by Trustwave's SpiderLabs team in a December blog post.

Under this attack scenario, a OneNote e-mail attachment includes a Windows Script File that launches Formbook malware, which the SpiderLabs team described as "an information stealing trojan sold on an underground hacking forum since mid-2016 as malware-as-a-service." The attackers apparently are using this method because Microsoft has addressed some "mark-of-the-web" failures with ZIP and ISO e-mail attachments, plus it disabled macros in attached Office files, which had permitted the sending of malicious scripts.

Microsoft's reaction to the OneNote attack shift, as reported by Bleepingcomputer.com and Born's Tech and Windows World, is to block certain executable files in OneNote, starting with the April-released OneNote version 2304 product update. The details are described in this Microsoft document.