Controversies

Microsoft AI chief publicly criticises Anthropic's Claude training approach and warns of 'silicon species' risk

Public backlash

In September 2026, Microsoft AI chief Mustafa Suleyman publicly criticised rival Anthropic for training its AI model Claude with human-like qualities. Suleyman called the approach 'misguided'. He also warned that uncontrolled AI development could produce a 'silicon species' that competes with humans. The remarks concerned both a competitor's AI training method and broader risks from advanced AI. The event was reported as a public controversy involving Microsoft's AI leadership and Anthropic's Claude. It centred on Suleyman's criticism of Anthropic's approach and his warning about a possible 'silicon species'.

Stated objective. Greater transparency around how AI systems are trained and evaluated, including independent scrutiny of AI behaviour and stronger tools to monitor and control the technology

Microsoft expands 'biomimicry' program at data centers amid local pushback over pollution and noise

Company response

In September 2026, Microsoft announced it would expand its 'biomimicry' initiative from a project begun in the Netherlands in 2022 to more than 20 sites in the United States and Germany. The initiative seeks to blend data centers into the natural landscape through native planting, ecosystem restoration, and plant buffers to muffle noise. The announcement followed pushback from communities near Microsoft data centers over construction impacts, pollution, noise, tree loss, and water and electricity demand. Advocates described the nature-based projects as positive but insufficient given Microsoft's growing greenhouse gas emissions and resource footprint.

Microsoft announced plans in September 2026 to expand its 'biomimicry' initiative — blending data centers into the natural landscape with native planting, ecosystem restoration, and plant buffers to muffle noise — from a project started in the Netherlands in 2022 to more than 20 sites in the US and Germany. The announcement comes as communities near its data centers push back over construction impacts, pollution, noise, tree loss, and water and electricity demand; advocates called the nature-based projects positive but insufficient given Microsoft's growing greenhouse gas emissions and resource footprint.

Stated objective. Blending datacenters into the natural landscape to 'create resilient ecosystems that support biodiversity, strengthen community ties, and help our datacenters become better neighbors.'

Sen. Warren and Senate Democrats send letters to Meta, Google, Amazon and Microsoft seeking information on AI tax subsidies

Investigation

Sen. Elizabeth Warren, D-Mass., joined by Democratic Sens. Tina Smith and Jeff Merkley, sent letters Sunday night to the CEOs of Meta, Google, Amazon and Microsoft seeking information on tax deductions the companies claimed for AI and data center development under the 2025 'one big beautiful bill' act and on their lobbying efforts ahead of the bill's passage. The letters cite falling corporate tax payments even as revenues rise, and request answers by Oct. 12. Spokespeople for all four companies did not immediately respond to a request for comment.

Stated objective. Seek information on tax deductions claimed related to AI and data center development and on lobbying efforts in the lead-up to the passage of the 2025 'one big beautiful bill' act, with answers requested by Oct. 12.

Vice President JD Vance accuses Microsoft of replacing laid-off workers with foreign hires

Issue disclosure

At the Oct. 8, 2026 press conference announcing the PERM suspensions, Vice President JD Vance accused Microsoft of replacing the 6,000 workers it laid off in 2025 with people on H-1B work visas. The report notes the allegation is unproven: USCIS data shows two-thirds of Microsoft's more than 6,000 H-1B approvals last year went to people already working at the company.

Stated objective. To express dissatisfaction with the employer's unfair labor practices and apply public pressure

Microsoft responds to controversy over Bing search promotion tool

Company response

Microsoft responded to controversy over its new Microsoft Recommended Search Settings app, which can change the default search engine and homepage across browsers to Bing. Microsoft said the tool is optional, is not distributed through Windows or Edge, and will not change any default settings without user consent.

Norway's Datatilsynet fines Microsoft-owned Xandr 92 million NOK over Grindr user data

Fine or penalty

Norway's data protection authority Datatilsynet fined Microsoft's advertising technology subsidiary Xandr 92 million Norwegian kroner (approximately $9.6 million) for unlawfully processing personal information associated with Grindr users, conduct that took place between July 2018 and April 2020, before Microsoft acquired Xandr in 2022. The regulator found Xandr assumed Grindr had obtained the required consent but failed to verify it or establish a valid legal basis for its own processing. The fine, described as the largest ever issued by the authority, ends a case begun by a January 2020 complaint from privacy group Noyb; Xandr has three weeks to appeal.

Researcher discloses ShieldBreak PoC bypassing Microsoft Defender patch for CVE-2026-50656

Issue disclosure

A security researcher using the handle "Nightmare Eclipse" published a proof-of-concept exploit named ShieldBreak that reportedly bypasses Microsoft's patch for CVE-2026-50656, allowing an attacker with existing system access to gain admin/root privileges. Microsoft said it is investigating the validity and applicability of the claims. Independent confirmation of the PoC's effectiveness was reported by security consultant Steven Eric Fisher, and researcher Kevin Beaumont published Advanced Hunting detection rules for ShieldBreak.

Microsoft and Japan's National Police Agency take down YAM Store phishing network behind over a billion scam messages

Company response

Microsoft, working with Japan's National Police Agency and the health-sector cybersecurity non-profit Health-ISAC, reported that it helped dismantle a scam-message marketplace called YAM Store along with the phishing kits CoGUI and Iron Man. According to Microsoft, since January 2026 these platforms enabled more than one billion malicious messages targeting over 75,000 organizations worldwide in more than 150 countries, including more than 750 million messages geared toward Microsoft customers. Microsoft said it disabled over 20,000 accounts connected to YAM Store, blocked over 100,000 web domains used for impersonation and fraud, and with Health-ISAC seized and redirected web domains powering all three platforms.

eMudhra cryptographic flaw disclosed

Issue disclosure

A security researcher identified weaknesses in private keys associated with eight intermediate Certificate Authorities used by eMudhra's global TLS business. eMudhra acknowledged human errors in the key-generation process, while saying its infrastructure had not been compromised and no data was breached.

Senate report criticizes data-center operators’ grid-cost positions

Issue disclosure

A report by Democratic U.S. senators stated that companies accepted paying for infrastructure dedicated to their data-center sites but opposed requirements to cover the full cost of wider grid improvements tied to their facilities. The report criticized the data-center operators' positions on grid costs. The article does not specify which companies took each position.

A report by Democratic U.S. senators said companies accepted paying for infrastructure dedicated to their data-center sites but opposed requirements to cover the full cost of wider grid improvements tied to their facilities. The article does not specify which companies took each position.

Report highlights Microsoft hosting components of Al Munasseq in Ireland

Issue disclosure

A report by the consumer group Ekō stated that Microsoft hosted key components of Al Munasseq in data centres in Ireland. According to the report, this hosting effectively enabled what it described as being feared to be mass surveillance. The report focused on Microsoft's role in providing data centre infrastructure for these components located in Ireland.

A report by consumer group Ekō found that Microsoft hosted key components of Al Munasseq in data centres in Ireland; the report said this effectively enabled what is feared to be mass surveillance.

Teams and Microsoft 365 bundling investigation

The European Commission investigated whether bundling Teams with Microsoft 365 and Office 365 disadvantaged competing collaboration products. The matter increased regulatory pressure on Microsoft’s enterprise-software packaging.

Cybersecurity governance criticism

Following significant cyber incidents and government reviews, Microsoft faced criticism concerning the security of its products, cloud services, identity systems, and internal security priorities.

Microsoft agrees to undertakings on Xbox subscriptions in Britain

Settlement

In a controversy note concerning Microsoft's Xbox subscriptions in Britain, the UK Competition and Markets Authority said it secured undertakings from Microsoft. According to the regulator, the undertakings concern Xbox subscription auto-renewals, price-rise information, cancellation assistance for inactive customers and pro-rata refunds. The source report is dated 26 January 2022.

Stated objective. The CMA said the undertakings would help gamers avoid paying for services they no longer use.

Microsoft agrees to changes to Xbox subscription practices in Britain

Settlement

The UK's Competition and Markets Authority obtained undertakings from Microsoft regarding concerns about Xbox subscription auto-renewals. Under the commitments, Microsoft agreed to provide upfront information about auto-renewal, contact inactive customers with guidance on stopping payments, give clearer notice of future price increases, and offer eligible annual subscribers an option to end their contracts and claim pro-rata refunds. The undertakings addressed the competition authority's concerns about how the subscription practices were presented to customers.

The UK's Competition and Markets Authority secured undertakings from Microsoft addressing concerns about Xbox subscription auto-renewals. Microsoft agreed to provide upfront auto-renewal information, contact inactive customers with guidance on stopping payments, give clearer notice of future price hikes, and offer eligible annual subscribers an option to end contracts and claim pro-rata refunds.

Stated objective. Clearer information will help gamers avoid being charged for services they have stopped using.

Arigna Technology sues seven companies over Qualcomm components

Lawsuit filed

Arigna Technology filed a complaint in the Western District of Texas against Alphabet, Apple, Lenovo, Microsoft, OnePlus, Samsung, and TCL, alleging that their devices incorporated Qualcomm envelope-tracking modules covered by its patent.

Microsoft pledges policy review and public release of investigation results

Company response

Microsoft announced a review of its sexual-harassment and gender-discrimination policies and said it would publicly release results of investigations into allegations involving board members and senior leadership. The board said Microsoft would hire a third-party law firm to conduct the review.

Stated objective. assess the company’s practices, benchmark those policies against best practices adopted by other companies, and look at steps taken to hold employees and executives accountable

Microsoft discloses Nobelium cyberattack and employee-account compromise

Issue disclosure

Microsoft reported a cyberattack campaign that it attributed to Nobelium. According to Microsoft, the group compromised Microsoft employee accounts and obtained software instructions governing how Microsoft verifies user identities. Microsoft stated that it removed the access and secured the affected device. The disclosure described the incident as a cyberattack campaign linked to Nobelium and addressed the compromise of employee accounts and the acquisition of identity-verification software instructions, along with the remedial steps the company said it took.

Microsoft reported a cyberattack campaign attributed to Nobelium and said the group had compromised Microsoft employee accounts and taken software instructions governing how Microsoft verifies user identities. Microsoft said it removed the access and secured the affected device.

Nextcloud-led coalition files complaint over Microsoft bundling

Issue disclosure

In late 2021, Nextcloud, supported by 29 other European companies, filed a complaint with EU and German antitrust authorities alleging that Microsoft aggressively bundles OneDrive, Teams and other services with Windows 10 and 11. The complaint was reported as an allegation; the source article does not state that authorities reached any determination on the matter. The event concerns the practice of tying multiple services to the Windows operating system and the resulting competition concerns raised by the coalition.

Nextcloud, backed by 29 other European companies, filed a complaint with EU and German antitrust authorities alleging that Microsoft aggressively bundles OneDrive, Teams and other services with Windows 10 and 11. The article reports allegations, not a determination by authorities.

Microsoft says it is working to fix Forza Horizon 5 name filter

Company response

In November 2021, Microsoft stated that it was working to fix an issue in Forza Horizon 5 after the game's in-game registration-plate filter blocked some names as inappropriate content. The filter, which screens user-generated text in the racing title, flagged certain names and prevented them from being used. Microsoft acknowledged the problem and said a fix was underway, without providing further details on the cause or the scope of the affected names. The statement followed reports that players had encountered the filter blocking legitimate names. The company did not specify a timeline for the correction.

Microsoft said it was working on a fix after Forza Horizon 5's in-game registration-plate filter blocked some names as inappropriate content.