Your Windows Laptop Runs AI You Never Turned On. We Traced Where the RAM and Heat Go.

A Laptop That Was Hot and Full While Doing Nothing

A Windows 11 machine, 32 GB of RAM, a 24-thread AMD chip with a neural processing unit on board. Modern, fast, the kind of laptop a company hands to a senior engineer. And it was running hot and sluggish while the user was barely touching it.

The instinct in that situation is to blame a browser tab or to start closing apps at random. We did the opposite: we measured before we touched anything. The numbers told a different story, and the story matters far beyond one warm laptop.

"8% CPU" and Still Hot Is a Real Signal, Not a Contradiction

First measurement, instantaneous CPU load across all cores: 8%. The machine was, by any normal definition, idle.

A quick trap to avoid here. Task Manager and Get-Process will happily show you a Chrome process with "9174" next to it and make you think Chrome is hammering the CPU. That number is cumulative CPU seconds since the process started, not current load. Sort by it and you will chase the wrong thing. The instantaneous sample is the one that matters, and it said 8%.

So if the CPU is asleep, where is the heat coming from? Two places that have nothing to do with compute:

• The GPU. Every browser tab with hardware acceleration keeps the integrated GPU warm even at idle CPU. Two browsers open at once doubles that for no benefit.
• Memory pressure. This was the real tell. RAM sat at 71% used, with 1.46 GB held by Memory Compression and committed memory at 34 GB against 31 GB of physical RAM. The machine had already been forced to page to the SSD. Compression and paging run constantly under pressure, they keep the controller busy, and they keep the fans spinning while the CPU graph stays flat.

Heat at idle is rarely a compute problem. It is usually a memory problem or a hardware one. So we went looking for what was eating the memory.

Where 22 GB of RAM Actually Went

People look at Task Manager, add up the top few apps, get to roughly 10 GB, and ask where the other half went. Here is the honest, full accounting on this machine:

| Bucket | Amount | What it is | |---|---|---| | All processes (not just the top ones) | ~16.3 GB | dozens of small processes below the fold, 99 svchost instances | | Memory Compression | 1.46 GB | RAM Windows compressed because it was full | | Kernel paged pool | 1.1 GB | the OS itself | | Drivers (non-paged pool) | 1.5 GB | device drivers | | Hardware reserved | 0.9 GB | taken by firmware and the integrated GPU before Windows even sees it |

Nothing vanishes mysteriously. But about 5 GB lives in kernel, compression, and drivers that never show up as an "app," and the integrated GPU quietly skims another gigabyte. That is normal. What was not normal was a single process holding 4.1 GB on its own: WorkloadsSessionHost.

WorkloadsSessionHost: The AI You Did Not Install

WorkloadsSessionHost.exe is the host process for Windows AI workloads. To see what it was actually running, we listed the AI component packages installed on the machine. A sample of what came back:

WindowsWorkload.SemanticText.*          (semantic understanding of your text)
WindowsWorkload.ImageSearch.*           (AI search across your images)
WindowsWorkload.ImageTextSearch.*       (reading text inside your images)
WindowsWorkload.TextRecognition.*       (OCR on screen content)
WindowsWorkload.ScrRegDetection.*       (screen region detection)
WindowsWorkload.ContentExtraction.*     (pulling structured content out of files)
WindowsWorkload.ImageContentModeration.*
WindowsWorkload.OnnxRuntime.*           (the AI model runtime)
WindowsWorkload.EP.AMD.VitisAI.*        (AMD NPU execution provider)
MicrosoftWindows.Client.CoreAI

Read that list again. This is on-device AI that indexes your documents, reads the text inside your screenshots and images, performs OCR on screen regions, and extracts content from your files. On a fresh boot it starts indexing, which is exactly when the RAM and the heat spike. Nobody opted into this. It arrived with a Windows update and started reading.

One detail worth being honest about: on this specific machine, Recall (the feature that periodically snapshots your screen) was already in a DisabledWithPayloadRemoved state, so the snapshots were not running. The semantic and image indexing stack, however, was very much alive. The point is not one scary feature. The point is a whole class of background AI you never see and never approved.

You Cannot Kill It. You Have to Turn the Feature Off.

The obvious move is to end the process. We tried. It respawned within seconds, and came back larger, climbing past 7 GB. A watchdog relaunches it aggressively because the indexing feature is enabled. Killing the process is treating the symptom. You have to disable the feature.

Here is the reversible approach we used. Everything below can be undone, and at an organization you should be doing this through Group Policy or Intune, not by hand on each laptop.

# Copilot off (per-user and machine-wide)
New-Item 'HKLM:\Software\Policies\Microsoft\Windows\WindowsCopilot' -Force
Set-ItemProperty 'HKLM:\Software\Policies\Microsoft\Windows\WindowsCopilot' TurnOffWindowsCopilot 1
 
# Windows AI data analysis + Recall snapshots off
New-Item 'HKLM:\Software\Policies\Microsoft\Windows\WindowsAI' -Force
Set-ItemProperty 'HKLM:\Software\Policies\Microsoft\Windows\WindowsAI' DisableAIDataAnalysis 1
Set-ItemProperty 'HKLM:\Software\Policies\Microsoft\Windows\WindowsAI' AllowRecallEnablement 0
Set-ItemProperty 'HKLM:\Software\Policies\Microsoft\Windows\WindowsAI' TurnOffSavingSnapshots 1

We also disabled the usual background tax: the DiagTrack telemetry service, dmwappushservice, and a set of scheduled tasks for the Customer Experience Improvement Program and compatibility telemetry. All reversible with a single Set-Service or Enable-ScheduledTask command.

What We Deliberately Left Alone

This is the part that separates a careful cleanup from a forum guide that breaks your machine. We did not remove the NPU driver or the AMD VitisAI framework. The neural processor itself is good hardware. At idle it draws close to zero watts, and it offloads legitimate AI work from your CPU and GPU. Strip it out and you break the driver, break Windows Update, and lose things like camera background effects in calls.

The distinction is simple and it is the whole lesson: keep the hardware capability, cut the parasite services. You are not anti-AI. You are deciding what runs on your machine instead of letting it decide for you.

The Result

After the cleanup and a restart:

• RAM: 71% down to 47%
• Memory Compression: 1.46 GB down to 0
• CPU at idle: 8% down to 4%

That zero on Memory Compression is the one that counts. It means the machine stopped fighting itself for memory. One more piece of honesty, because we sell honesty: if a laptop still runs hot after this, with the CPU under 5% and RAM under 65%, the problem is no longer software. It is dust in the fan or dried thermal paste, and no registry key fixes that.

Why This Is a Security Problem, Not a Performance Tip

Everything above reads like a "speed up your laptop" article. It is not. Multiply that one machine by every Copilot+ PC in a company.

You now have on-device AI on dozens or hundreds of endpoints, indexing documents, reading the text inside images, performing OCR on whatever is on screen, and in the Recall case, snapshotting the screen itself. It was enabled by a vendor update, not by your IT team. Nobody assessed what data it touches. Nobody decided whether it is appropriate for a machine that handles client contracts, patient records, or source code.

That is the textbook definition of shadow AI: AI processing inside your perimeter that your governance never approved and cannot see. Under GDPR, unassessed processing of potentially special-category data is a liability whether or not anything leaks. Under the EU AI Act, "we did not know it was running" is not a defense; deployers are expected to know what AI operates in their environment. The risk is not that Microsoft is malicious. The risk is that you cannot govern what you cannot see, and most organizations currently cannot see this at all.

The fix at scale is not a PowerShell snippet on one laptop. It is an inventory of what AI is actually running across your fleet, a policy decision about what is allowed, and enforcement through your management tooling. That is governance work, and it is exactly the kind of work that gets skipped because the AI in question never announced itself.

What DeviDevs Does Here

We secure AI systems for a living, which means we spend our time finding the AI that nobody is looking at. The background indexer on a Copilot+ laptop is a small, concrete example of a much larger pattern: capable AI showing up inside organizations faster than anyone can govern it.

If you run a company and this article made you wonder what is running on your team's machines, that instinct is correct, and answering it properly is the first step of an AI security posture. We help organizations inventory the AI in their stack, decide what belongs there, and enforce it, from the endpoint up to the models in production.

You do not have to be anti-AI to want to know what your AI is doing. You just have to be the one who decides.