Windows 11 Copilot Sent Network Traffic After Closing: What One Test Found and How to Stop It

What the capture found​

Raj logged the network connections of several AI desktop apps on his PC. He sent no prompts and touched nothing. Copilot was the standout. He opened it, then quit it from the tray icon "the way I would close any other application."

Over the next 34 minutes, he reports, Copilot sent 205 KB to 18 separate internet addresses. About 90% of that went out in the first five minutes. The last connection came at the 16-minute mark. Copilot was still listed in Task Manager when he stopped logging.

He broke the destinations down by owner using WHOIS lookups:

A few details are worth noting:

• The heaviest Microsoft destination, 51.11.192.52, resolves to a Microsoft-maintained block routed under AS8075.
• The Cloudflare address, 104.18.18.203, was the busiest destination overall.
• The per-owner figures add up to 204 KB rather than 205 KB. That is most likely rounding, but the raw capture would be needed to confirm it.
• Eighteen addresses do not mean eighteen companies. Most of the traffic went to Microsoft's own ranges.

For comparison, Raj says Google's Gemini Windows app exited fully about 58 seconds after he closed it, and sent nothing afterwards. He notes that other users have reported Gemini processes surviving a window close. Treat that as one observation on one machine, not a ranking of the two apps.

Why this is a setting, not (necessarily) a bug​

Raj argues the behavior is by design. Community documentation backs that up. Windows 11 Forum's tutorial says that from Copilot app version 146 onward, users can choose whether the app keeps running after it is closed. When the option is on, Copilot stays running in the background and its icon remains in the taskbar system tray, where you can reopen or quit it. When it is off, the app fully closes.

The same tutorial describes a different location and label than Raj does. It says to go to General, then App behavior, and set "Keep running after you close Copilot" on or off (off is the default). Another guide, from Geek Rewind, uses the older wording. It says the "On close, keep the app running" setting lives inside the app, at Account › Settings › Preferences, not in the Windows Settings app.

So the wording and menu path appear to have changed between builds. Look for whichever version your Copilot build shows. If your build has no such toggle, update the app before assuming something is wrong.

Windows 11 Forum also draws a distinction that explains Raj's result. With the keep-running option on, you must quit Copilot, not just close it, to fully exit and remove its tray icon. Closing the window and quitting the app are separate actions.

What the traffic does and doesn't prove​

This is where careful reading matters.

What a Procmon-style capture can show:

• Which process connected to which address.
• How many bytes moved in each direction.
• When the connections happened.

What it cannot show:

• What the encrypted payloads contained.
• Why a given connection was made.
• Whether the traffic was diagnostics, update checks, sync, content loading or something else.

Raj says plainly that none of this makes Copilot spyware. It means the app stays awake after you tell it to close. I would add two cautions.

• There is no baseline. Without comparing against other apps or other Copilot builds, 205 KB is neither large nor small. It is a number from one test.
• Owner lookups only go so far. A Cloudflare or Akamai address tells you who runs the server, not whose content is behind it. The biggest transfer in the capture, 1.78 MB received from a Cloudflare address, is therefore the least explained part of the story.

Microsoft's Copilot privacy FAQ gives general context. It says Copilot for Windows collects a set of required diagnostic data to keep the app secure, up to date and performing as expected. That page, however, states that its content applies to the older Copilot app. Microsoft says an updated Copilot app became available on August 18, 2026. The FAQ cannot tell us what these particular bytes were, and I am not claiming they were diagnostics.

One more caveat on the source. Raj says a Microsoft community support specialist advised ending the process in Task Manager or stopping Copilot from starting with Windows, in a reply from April 2025. That is a forum reply, not official product documentation, and I could not verify it independently. I have also left out his claim about Copilot auto-launching on some Windows 11 setups in January 2024, because the supplied evidence did not establish it.

Check it yourself​

Raj used Process Monitor (Procmon), a free Sysinternals tool from Microsoft. His steps:

1. Open Procmon and go to Filter. Add an include rule for Operation begins with TCP, add another for UDP, and enable Drop Filtered Events.
2. Under Options, turn on Show Resolved Network Addresses so you see hostnames where available, not only bare IPs.
3. Close the apps you want to test.
4. Press Ctrl+E to start capturing. Leave the PC idle for a set period, then press Ctrl+E again to stop.
5. Open Tools > Network Summary to see destinations and byte counts per process.

These are Raj's reported steps. I could not confirm the exact workflow against Microsoft's own Procmon page in the material I reviewed. Menu labels may differ slightly between Procmon versions, so go by what your build shows.

To make your result meaningful:

• Note the app version, your Windows build, and whether you were signed in.
• Record exactly how you closed the app: the window button, the tray Quit command, or Task Manager.
• Run the capture more than once. Start-up and update traffic can look different from steady-state chatter.
• Close other network-heavy apps first, so their traffic does not muddy the results.
• Check Task Manager to see whether the process is still alive.

If you want Copilot to stay closed​

• Open Copilot's settings and look for the keep-running option, under either of the labels above. Turn it off.
• If you leave it on, quit Copilot from its tray icon rather than just closing the window.
• Confirm the result in Task Manager. If the process is gone, it is not talking to anyone.
• If you would rather not have the app at all, you can uninstall it. Raj suggests that route for anyone who is uncomfortable with the behavior.

Bottom line​

This is one capture, on one PC, with an unreported Windows and Copilot build. It shows a Microsoft app that remained resident and connected after a tray close. That fits a documented, user-controllable setting. It does not show what the traffic contained, and it is not evidence of data theft. The more useful takeaway is the habit: check Task Manager and a quick Procmon capture before assuming "closed" means "stopped."