I watched every network request my AI desktop apps make, and one sent far more than I expected

I conducted an investigation into the network connections made by several AI desktop apps installed on my computer, without any prompts or active interaction. To my surprise, I discovered that one of these apps, Microsoft's own Copilot, sent 205KB of data to 18 different internet addresses during a 34-minute period, even after I had closed it from the system tray.

This behavior persisted, as Task Manager still listed the process when I stopped the capture. Upon further research, I found that 14 of these addresses belonged to Microsoft, while the remaining connections were routed through Akamai edge nodes, Cloudflare, and another Cloudflare address. This consistent behavior of remaining connected after closing is not exclusive to Copilot, as Gemini's Windows app also failed to shut down completely in my tests.

Microsoft has been moving towards this design decision, with Copilot offering an "On close, keep the app running" preference since version 146. While this may not necessarily indicate malicious behavior, it is worth noting for users concerned about background processes on their Windows systems. Users can use Process Monitor, a free Microsoft utility, to log and analyze such activities on their own PCs.