llm security

The UK National Cyber Security Centre’s blunt advisory about AI prompt injection is a wake-up call: defenders who treat prompt injection like a modern variant of SQL injection risk leaving their systems exposed to a different, harder-to-defend class of attacks that exploit the very way large...

Microsoft’s security team has unveiled a startling new privacy risk for cloud-hosted chatbots and search assistants: a side‑channel exploit dubbed Whisper Leak that can infer the topic of a user’s conversation with an LLM (large language model) even when the traffic is encrypted with TLS. The...

Microsoft’s security team has disclosed a new side‑channel called Whisper Leak that can reliably infer the topic of a user’s prompts to streaming large‑language models (LLMs) by observing encrypted network metadata — packet sizes and timings — even when TLS is correctly applied. This disclosure...

Microsoft’s security team has published a troubling technical disclosure showing that encrypted conversations with streaming language models can leak topic-level information to a passive network observer by analyzing encrypted packet sizes and timings — a novel side-channel the researchers call...

Australia’s small businesses face a sharp security cliff this month as Microsoft ends mainstream support for Windows 10, and researchers warn that a parallel surge in AI‑enabled attack techniques is widening the window of opportunity for criminals — a risk compounded by many organisations...

ChatGPT and Google Bard briefly began handing out what looked like Windows 10 and Windows 11 product keys in plain text — a minor internet spectacle with major implications for AI safety, software licensing and everyday Windows users — a viral Mashable thread first flagged after a Twitter user...

Here is a summary of the recent Microsoft guidance on defending against indirect prompt injection attacks, particularly in enterprise AI and LLM (Large Language Model) deployments: Key Insights from Microsoft’s New Guidance What is Indirect Prompt Injection? Indirect prompt injection is when...

Artificial intelligence agents powered by large language models (LLMs) such as Microsoft Copilot are ushering in a profound transformation of the cybersecurity landscape, bringing both promise and peril in equal measure. Unlike conventional digital threats, the new breed of attacks targeting...

The world of artificial intelligence, and especially the rapid evolution of large language models (LLMs), inspires awe and enthusiasm—but also mounting concern. As these models gain widespread adoption, their vulnerabilities become a goldmine for cyber attackers, and a critical headache for...

Here’s an executive summary and key facts about the “EchoLeak” vulnerability (CVE-2025-32711) that affected Microsoft 365 Copilot: What Happened? EchoLeak (CVE-2025-32711) is a critical zero-click vulnerability in Microsoft 365 Copilot. Attackers could exploit the LLM Scope Violation flaw by...

In January 2025, security researchers at Aim Labs uncovered a critical zero-click vulnerability in Microsoft 365 Copilot AI, designated as CVE-2025-3271 and dubbed "EchoLeak." This flaw allowed attackers to exfiltrate sensitive user data without any interaction from the victim, marking a...

Here’s a concise summary and analysis of the 0-Click “EchoLeak” vulnerability in Microsoft 365 Copilot, based on the GBHackers report and full technical article: Key Facts: Vulnerability Name: EchoLeak CVE ID: CVE-2025-32711 CVSS Score: 9.3 (Critical) Affected Product: Microsoft 365 Copilot...

In recent developments, cybersecurity researchers have uncovered a critical vulnerability in Microsoft Copilot, an AI-powered assistant integrated into Office applications such as Word, Excel, Outlook, and Teams. Dubbed "EchoLeak," this flaw enables attackers to exfiltrate sensitive data from a...

Here are the key details about the “EchoLeak” zero-click exploit targeting Microsoft 365 Copilot as documented by Aim Security, according to the SiliconANGLE article (June 11, 2025): What is EchoLeak? EchoLeak is the first publicly known zero-click AI vulnerability. It specifically affected...

In June 2025, a critical "zero-click" vulnerability, designated as CVE-2025-32711, was identified in Microsoft 365 Copilot, an AI-powered assistant integrated into Microsoft's suite of productivity tools. This flaw, dubbed "EchoLeak," had a CVSS score of 9.3, indicating its severity. It allowed...

In a landmark revelation for the security of AI-integrated productivity suites, researchers have uncovered a zero-click data leak flaw in Microsoft 365 Copilot—an AI assistant embedded in Office apps such as Word, Excel, Outlook, and Teams. Dubbed 'EchoLeak,' this vulnerability casts a spotlight...

As large language models move from academic curiosities to essential engines behind our chats, code editors, and business workflows, the stakes for their security could not be higher. Organizations and developers are racing to leverage their capabilities, drawn by promises of productivity...

A newly disclosed vulnerability in the AI guardrails engineered by Microsoft, Nvidia, and Meta has sparked urgent debate over the effectiveness of current AI safety technologies. Researchers from Mindgard and Lancaster University exposed how attackers could exploit these guardrails—systems...