I watched every network request my AI desktop apps make, and one sent far more than I expected

Published Nov 13, 2026, 12:30 PM EST Abhinav pivoted from a career in banking to pursue his first love in writing. Even while working full-time, he continued contributing as an editor-at-large, a role he has held for more than 7 years. A lifelong tech enthusiast who has built three gaming and productivity powerhouse PCs since 2018, his passion for technology keeps him closely following the semiconductor industry, from NVIDIA and AMD to ARM. His MSc dissertation explored how artificial intelligence will reshape the future of work, reflecting his curiosity about the wider social impact of emerging technologies. I have several AI desktop apps on my PC, all of which I believed remained idle and closed when I'm not typing into them. Of course, I had never bothered to check whether that was true, so I spent an evening logging every network connection they made, with no prompts sent, and nothing touched. I initially assumed that the interesting number in my findings would be how much each app sends while you're chatting with it, but I stumbled upon something more intriguing. One of these apps happened to be Microsoft's very own, and it sent 205KB to 18 separate internet addresses over the course of 34 minutes, and every byte of that went out after I had already quit it from the system tray. Of course, this had happened because closing the app did not, in fact, fully close it. It was sitting in Task Manager, still connecting to its servers, and the only reason I ever found out was that I happened to be watching. Quitting Copilot from the system tray does not make it stop phoning home Copilot kept talking for 16 minutes after I shut it Credit: Whois.comCredit: Whois.com Before I began logging, I opened Copilot, and then quit it from the system tray icon the way I would close any other application. Over the next 34 minutes, it sent 205KB to 18 separate internet addresses, roughly 90% of that inside the first five minutes, with its last connection at the 16-minute mark. The process was still listed in Task Manager when I stopped the capture. Looking up who owns those addresses revealed that 18 addresses aren't 18 different companies, though. Fourteen of these belong in Microsoft's own ranges and took 111KB between them, which is a little over half of everything the app sent. A WHOIS on the heaviest of them, 51.11.192.52, returns a block maintained by Microsoft and routed under AS8075. Three more are Akamai edge nodes, which took another 34KB. The last is a single Cloudflare address, 104.18.18.203, and it's the busiest destination in the whole capture with 59KB going out and 1.78MB coming back. WHOIS confirms that the block belongs to Cloudflare, but that's as far as WHOIS takes you, because a CDN address tells you who runs the server rather than whose content sits on it. Owner Hosts Sent Received Microsoft 14 111KB 165KB Akamai 3 34KB 45KB Cloudflare 1 59KB 1.78MB By comparison, Gemini's Windows app shut down the way I had assumed all of them did. I closed it the same way, and both of its processes exited about 58 seconds later, after which it sent nothing at all, as there was nothing left running to send anything. It's worth noting that Gemini is not always this well-behaved on Windows, and users have reported its processes surviving a window close as well. In my testing, though, it did quit cleanly. None of this is a bug, because Microsoft ships it as a setting The company's own advice for stopping Copilot is to end the process The behavior that I observed on my PC isn't anomalous or a malfunction in any sense. As a matter of fact, Copilot has carried a preference called, "On close, keep the app running" since version 146, which can be found in the app's settings under Preferences. In that sense, the app lingering in the background after you close it from the system tray is a design decision, and not an accident. Microsoft has been moving in that general direction for a while now. Copilot was quietly set to launch automatically on certain Windows 11 setups back in January 2024, however, it never quite became the default. The app today has an auto-start on login preference that ships switched off. The one behavior it hasn't walked back, apparently, is the one I observed, wherein the app stays resident and connected after you close it. What I couldn't find was Microsoft's acknowledgment of that part. The closest thing to an official answer to it dates back to April 2025, when a Microsoft community support specialist replied to a user asking how to disable the Copilot app. Their advice was to end the process in Task Manager, or stop it from starting with Windows. You can run this check on your PC in ten minutes Here's how I did it To run this check on your own PC, you can use Process Monitor, which is a free Microsoft utility from the Sysinternals suite, available to download from Microsoft's Sysinternals page. The app is useful for logging various processes on your PC, so it's nice to have it on your desktop if you're curious about what your apps have been doing when you're away from the keyboard. The first thing you'd want to do is separate the noise from the signal. You'll have to open Filter, set Operation begins with TCP to Include, add a second for UDP, and tick on Drop Filtered Events. Under Options, turn on Show Resolved Network Addresses for hostnames instead of bare IPs. Then, close the apps you want to test, press Ctrl+E to start, and then let the machine run. Once you're done logging, hit Ctrl+E again to stop it, and then go into Tools, followed by Network Summary, which will give you every destination along with the bytes each process sent. It'll show you which processes connected to which address, how many bytes went each way and when, but what it won't show you is what was inside any of it, because the traffic is encrypted. It's worth doing some due-diligence on your running apps Contrary to what many would be led to believe reading all of this, none of what I've reported essentially makes Copilot spyware. It does, however, make it an app that stays awake after you tell it to shut down, which is worth knowing if you're on Microsoft Windows. If any of this doesn't sit right with you, you can always remove Copilot and the rest of Windows' bloatware.