Microsoft will finally let you uninstall Copilot


TL;DR

Microsoft’s April 2026 update lets users and administrators fully uninstall the Copilot app from Windows 11. The move follows poor adoption numbers, with only 3.3 per cent of eligible users paying for Copilot, and persistent criticism that Microsoft forced AI features on users without adequate control.

Microsoft has added the ability to fully remove the Copilot app from Windows 11. The change arrived in the April 2026 update and applies to both enterprise administrators using Group Policy and regular users who can now uninstall it through Settings like any other app.

For IT administrators, the new policy is called “Remove Microsoft Copilot app.” It sits under User Configuration, Administrative Templates, Windows Components, Windows AI in the Group Policy Editor. Administrators can also apply it through the Windows Registry. The policy will uninstall Copilot only if specific conditions are met: both Microsoft 365 Copilot and the standalone Microsoft Copilot must be installed, the user must not have manually installed the Copilot app, and the app must not have been launched in the past 28 days.

For home and Pro users, the path is simpler. Go to Settings, then Apps, then Installed Apps, search for Copilot, and select Uninstall. The app can be reinstalled later from the Microsoft Store if needed.

The 💜 of EU tech

The latest rumblings from the EU tech scene, a story from our wise ol’ founder Boris, and some questionable AI art. It’s free, every week, in your inbox. Sign up now!

The move is a concession. Since integrating Copilot across Windows 11 and the Microsoft 365 suite in 2023, Microsoft has positioned the tool as its centrepiece AI product. It embedded Copilot into the taskbar, Edge, Notepad, Office apps, and Outlook, all running in the background and enabled by default. Users who wanted it gone had to resort to PowerShell scripts, third-party debloating tools, or registry hacks. The new policy makes removal an official, supported option for the first time.

The timing reflects a broader problem with Copilot adoption. Only 3.3 per cent of Microsoft 365 users who have access to Copilot Chat actually pay for it. Of roughly 450 million Microsoft 365 seats, 15 million are paid Copilot subscribers. That is a conversion rate that suggests most users either do not find the tool useful enough to pay for or actively prefer to avoid it. Microsoft’s own terms of service describe Copilot as being “for entertainment purposes only,” a disclaimer that sits uncomfortably alongside a product marketed as a productivity tool priced at $30 per user per month.

The uninstall option is part of a wider Windows 11 cleanup effort. Microsoft has been removing legacy features and reducing pre-installed software in recent updates. WordPad was deprecated in 2024. The Tips app was removed. Cortana was discontinued. Letting users remove Copilot follows the same logic: if a feature is not being used, forcing it on people generates resentment rather than adoption.

Enterprise customers have been particularly vocal. IT administrators managing thousands of devices objected to Copilot being pushed to managed environments without adequate controls. Microsoft has been rethinking its AI strategy more broadly, launching its own MAI model family to reduce dependence on OpenAI and cutting internal Claude Code licences after the costs proved difficult to justify.

The 28-day inactivity condition on the Group Policy removal is worth noting. If a user has opened Copilot even once in the past four weeks, the policy will not uninstall it. Microsoft is clearly trying to preserve the app for anyone who has shown even minimal engagement while giving administrators a way to clear it from machines where it sits untouched.

The change does not affect Copilot features embedded elsewhere in Windows, such as AI suggestions in the Start menu search, AI-powered features in Paint and Photos, or Copilot integration in Edge. Removing the standalone Copilot app removes the dedicated AI chat interface but does not strip AI from the operating system entirely.

For Microsoft, the calculation is straightforward. A product that users actively resent and administrators work around is doing more harm to Windows sentiment than any AI feature is worth. Letting people remove it is cheaper than the support burden, community backlash, and enterprise friction that forcing it creates.

The broader pattern across the tech industry is similar. GitHub froze new Copilot sign-ups after agentic AI usage broke the economics of its pricing model. Google has faced pushback over AI Overviews in Search. Apple settled an AI exaggeration lawsuit for $250 million. The lesson is consistent: users will adopt AI tools that demonstrably improve their work, but they will push back hard against AI that is imposed on them without clear value.

Microsoft is learning that lesson in real time. The Copilot uninstall button is small, but the signal it sends is not. When a company that invested $13 billion in OpenAI admits that its flagship AI product should be optional, that is an acknowledgement that the current version has not yet earned its place on every desktop.



Source link

Leave a Reply

Subscribe to Our Newsletter

Get our latest articles delivered straight to your inbox. No spam, we promise.

Recent Reviews


Ghost CMS flaw abused to push ClickFix attacks on hundreds of sites

Pierluigi Paganini
May 25, 2026

Threat actors are actively exploiting a security flaw, tracked as CVE-2026-26980, in Ghost CMS that was fixed months ago in real attacks against unpatched websites. According to Qianxin, the campaign has already affected more than 700 sites, including well-known organizations and universities.

The vulnerability is an SQL injection issue in Ghost’s Content API that can let an attacker read data from the database without logging in. In the worst case, this can expose the Admin API key, which can allow attackers to take over the site.

That key matters because it can be used to change published content. In this campaign, attackers used it to edit articles on compromised Ghost sites and insert malicious JavaScript at the end of pages. The goal was not just defacement, but to turn trusted websites into launch points for further malware delivery.

“After an in-depth investigation and analysis, we determined that this was not a targeted intrusion against the customer, but rather a large-scale poisoning campaign by an in-the-wild attack group targeting Ghost CMS. Although CVE-2026-26980 was publicly disclosed as early as February 19, a large number of users did not patch and upgrade in time, providing an opportunity for attackers.” reads the advisory published by Qianxin. “At least two groups are currently actively conducting such poisoning operations, and some sites have even become the target of competition between the two parties, with different malicious code being implanted one after another within a single day.”

The inserted code led visitors through a two-step chain. First, the page loaded a remote script that checked the browser and decided what the visitor should see. Then real victims were redirected to a fake verification page that looked like a normal “I’m human” check.

This is where the ClickFix part began. The page told users to press Windows+R, paste a command, and hit Enter. In practice, that command downloaded and started a malware payload on the victim’s machine. It was a classic social engineering trick: make the user do the dangerous part themselves.

Qianxin says the first signs of this activity appeared in early May. The malicious code found in the campaign had a compilation date of February 16, the same day Ghost announced the fix for CVE-2026-26980. That suggests the attackers moved quickly once they saw how many sites had not been updated.

The affected websites cover a wide range of sectors. Roughly half are personal blogs or independent sites, but the list also includes technology blogs, AI sites, media outlets, crypto projects, and educational institutions. Qianxin researchers say victims include sites linked to Harvard, Oxford, and DuckDuckGo.

The attack chain was also designed to be flexible. The loaders could fetch different payloads depending on the target, and the operators changed infrastructure several times.

“entire attack process has obvious five-stage characteristics of “CMS Takeover → Page Poisoning → Two-stage Loading → Social Engineering Lure (FakeCaptcha/ClickFix) → Malware Delivery”, and the entire process is highly automated: bulk vulnerability scanning → automatic key extraction → bulk injection → dynamic C2 distribution.” states the report.

In some cases, they switched domains after detection, keeping the campaign alive even when part of the chain was blocked.

“Through feature scanning of publicly accessible pages, we have cumulatively identified more than 700 poisoned victim domains, and have proactively contacted the sites for which contact information could be obtained, notifying them of the poisoning.” continues the report.

Qianxin also believes at least two different groups are involved. In some cases, the same site was hit more than once, with one attacker replacing the code left by another. That makes the campaign harder to clean up and shows how attractive compromised Ghost sites have become for abuse.

For site owners, the advice is straightforward. Ghost should be updated immediately, all credentials should be rotated, and site logs should be reviewed for suspicious admin API activity. Any injected scripts should be removed from the database itself, not just from the visual editor. Visitors who may have reached a poisoned site should also be warned.

The report includes Indicators of Compromise (IoCs) for the attacks observed by the researchers.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Ghost CMS)







Source link