Microsoft Defender falsely flags legitimate Google search links as malicious

REDMOND, Wash. — Microsoft's security software is incorrectly identifying legitimate Google search results as malicious threats, disrupting access to the world's most popular search engine for enterprise users. The issue affects Microsoft Defender for Office 365 Safe Links, a feature designed to protect organizations from phishing and malware by scanning URLs in real time.

The malfunction was detected on Sept. 2, 2026, when users across multiple sectors reported that clicking on standard Google search links within Outlook or Teams triggered immediate security blocks. Instead of allowing access to the intended web pages, the system redirected users to a warning screen stating the link had been classified as dangerous. Microsoft confirmed the incident stems from an inaccurate security classification within its Safe Links engine, resulting in a wave of false positives.

Safe Links operates by rewriting URLs embedded in emails and documents. When a user clicks a link, the request is routed through Microsoft's scanning infrastructure before reaching the final destination. If the system flags a domain or specific URL as unsafe, access is denied to prevent potential compromise. In this instance, the classification algorithm erroneously tagged Google search result pages as hostile, despite the URLs being benign and originating from google.com.

The error has caused significant operational friction for businesses relying on Microsoft 365 for daily communication. Employees attempting to share research, news articles, or product information found their messages blocked upon opening by recipients. IT administrators reported a surge in help desk tickets as staff struggled to access routine web resources necessary for workflow continuity.

Microsoft stated that the issue is being addressed through an update to its threat intelligence filters. The company acknowledged that the classification logic required immediate adjustment to distinguish between legitimate search traffic and actual malicious activity. No data breaches or successful attacks were attributed to this specific glitch, as the error resulted in over-blocking rather than under-blocking of threats.

While Microsoft has begun rolling out corrections to its detection systems, the timeline for a full resolution remains unclear. Some users reported that links continued to be blocked even after initial patches were deployed, suggesting the issue may affect cached data or require updates across multiple server regions. Security analysts are monitoring the situation to ensure that the fix does not inadvertently lower protection levels against genuine threats.

As of late Tuesday, Microsoft had not issued a detailed statement regarding the root cause of the classification error or the specific criteria that triggered the false alarms. The incident raises questions about the precision of automated security filters and the balance between aggressive threat prevention and user accessibility. Until the classification engine is fully recalibrated, organizations may need to implement temporary workarounds to ensure employees can access critical information without interruption.