Microsoft Defender False Positive: Google Search Flagged as Dangerous

Microsoft Defender has caused a stir after its security system incorrectly identified Google Search links as dangerous threats. As a result, numerous Microsoft 365 users experienced difficulties opening Google search links shared via email or Microsoft Teams.

The issue occurred on 2 September 2026 and was related to the Safe Links feature within Microsoft Defender for Office 365. The incident, recorded under code MO14465962, lasted approximately seven and a half hours before Microsoft announced that the problem had been resolved.

Safe Links is a security feature in Microsoft Defender for Office 365 designed to inspect URLs before users open them, protecting against phishing, malware, and other cyber threats. However, on this occasion, the system misread several legitimate Google Search links as being unsafe.

Users attempting to open these links received a warning stating, “Opening this website might not be safe,” and access to the URLs was blocked. According to TechSpot, the issue was not limited to links opened via email or Teams; Safe Links protection also affected access when links were opened through external browsers.

While Microsoft Defender issued security warnings, Google Search did not actually contain malware. This incident was a ‘false positive’—a condition where a security system incorrectly identifies safe content as a threat. Microsoft confirmed the cause was an “inaccurate security classification” within the Defender threat detection process.

Microsoft has since rectified the issue and stated that the incident was resolved on 2 September 2026 at 10:17 UTC. Nevertheless, the company warned that some users might still experience temporary effects as the fix is rolled out across the entire service infrastructure. Microsoft also intends to review the URL reputation classification process within Defender to prevent similar errors from recurring.

This incident highlights that even automated security systems are not entirely free from detection errors, even when targeting internet services used in daily life.