It's an always-on AI that sits directly on your device inside a built-in Neural Processing Unit, or NPU, which takes screenshots every 5 seconds and scans the screenshots for information - including passwords, banking information, and other forms of PII. It then stores all of that information completely unencrypted, in a format that has been proven almost immediately after the beta preview to be able to be exfiltrated within seconds, easily, by a very simple piece of malware. The company claims that all the information is only stored locally, and after the backlash, that the AI would be opt-in only, but we've seen what Microsoft does with their "promises" before.