Microsoft’s flagship security software, Defender for Office 365, has been mistakenly flagging legitimate Google search links as malicious. The issue, which was first acknowledged by Microsoft on September 2nd, is causing users to see warning messages when trying to open blocked hyperlinks.
According to a service alert seen by CyberNews.work, the problem stems from an inaccurate security classification that’s causing Defender for Office 365’s Safe Links feature to misidentify legitimate Google search URLs as malicious. As a result, users are being prevented from accessing these links, and IT administrators may also receive alerts in Microsoft Sentinel and the Defender portal about this issue.
Safe Links is designed to block malicious links used in phishing and other attacks by rewriting inbound email messages during mail flow and performing time-of-click verification of URLs in email messages, Teams, and Office 365 apps. However, it appears that an error has crept into the system, causing legitimate links to be incorrectly flagged as suspicious.
Microsoft has assured customers that they are working to correct the misclassification and remediate the impact of this issue. In the meantime, users who encounter “Opening this website might not be safe” warnings when trying to access Google search links may find that copying the link and pasting it directly into a browser will not bypass the warning.
This is not an isolated incident – in recent years, Microsoft has faced similar issues with its security software mistakenly flagging legitimate emails or links as malicious. For instance, last year’s Exchange Online bug caused machine learning models to incorrectly flag emails from Gmail accounts as spam, while another issue prevented users from sending or receiving emails altogether.
The impact of this latest issue is still unclear, but Microsoft has classified it as an advisory – a service issue involving limited scope or impact. As the company continues to work on resolving the problem, users are advised to be cautious when interacting with Defender for Office 365 and to report any further issues to their IT administrators.
In practical terms, this incident highlights the importance of regularly monitoring security software and services to ensure they’re functioning correctly. Users should also remain vigilant when encountering warning messages from security software, verifying the accuracy of these warnings before taking action. By staying informed about potential security issues and being proactive in addressing them, users can help minimize the risk of false positives and stay one step ahead of cyber threats.
Source: Bleeping Computer — 2026-09-02