Microsoft Defender incorrectly flags Google search results as dangerous

Microsoft Defender experienced a technical failure that incorrectly flagged Google search results as dangerous, causing access blocks for users on Windows and Office 365.

The issue originated within the Safe Links module of Defender for Office 365, a tool designed to intercept phishing and malware in emails and Microsoft Teams. The filtering engine assigned an incorrect risk category to addresses generated by Google’s search engine. This resulted in users encountering red warning screens or experiencing immediate connection blocks when attempting to open standard links.

Beyond individual user disruption, the incident triggered a surge of automated security alerts across administration consoles and monitoring services like Microsoft Sentinel. Microsoft identified the cause as an internal inaccuracy in its threat classification process, specifically a reputation reading error within its own security infrastructure. The company confirmed there was no actual threat from Google servers or any targeted cyberattacks; the event was a large-scale false positive, cataloged internally under technical reference MO1465962.