Loading story…
Microsoft has revealed a new side-channel attack technique, dubbed Whisper Leak, that enables adversaries to infer the topics of conversations with remote large language models (LLMs) by analyzing encrypted network traffic. The attack leverages packet size and timing patterns in streaming-mode LLM communications, allowing a passive observer—such as a nation-state actor at the ISP level or someone on the same Wi-Fi network—to determine if a user's prompt relates to a sensitive subject, even though the traffic is protected by HTTPS encryption. This vulnerability poses significant privacy risks for both individual and enterprise users of AI chat services.
The Whisper Leak attack is notable because it bypasses traditional encryption safeguards by exploiting side-channel information inherent in the way LLMs stream responses. Microsoft researchers demonstrated that trained classifiers can match observed traffic patterns to specific conversation topics, raising concerns about the confidentiality of AI-assisted communications. The disclosure highlights the need for additional countermeasures to protect the privacy of users interacting with AI models over the internet, especially in environments where adversaries may have the capability to monitor encrypted traffic.
Track how attackers are adapting to this technology.
3 events from the most recent confirmed update back to the earliest known activity.
On its Security Blog, Microsoft publicly disclosed Whisper Leak, outlined the surveillance risks for users such as those on public Wi-Fi or in oppressive regimes, and shared defensive guidance. The post also referenced public research code and proof-of-concept materials.
Microsoft reported the Whisper Leak findings through responsible disclosure to affected providers before public release. According to the disclosure, multiple providers implemented mitigations to reduce the practicality of the attack, including response obfuscation measures.
Microsoft described Whisper Leak as a novel remote side-channel attack against streaming language models that infers the topic of prompts by analyzing encrypted traffic metadata such as packet sizes and timings. In controlled testing, the technique achieved very high topic-classification accuracy, including results above 98% in some scenarios.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
7 references tracked. Mallory keeps watching after this page renders.
go.theregister.com
Open sourcescworld.com
Open sourcesecurityonline.info
Open sourcecsoonline.com
Open sourcesecurityaffairs.com
Open sourcethehackernews.com
Open sourcemicrosoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers highlighted multiple ways **LLM adoption can introduce or amplify risk**, including both technical attacks and unsafe development practices. G DATA reported that a Git-hosted “detector” for the **Shai-Hulud worm** shipped with “test files” that were effectively *real malware*: scripts capable of deleting user directories and, in at least one case, uploading data to actual threat actors. The files were apparently intended to validate detection efficacy and may have been produced via AI-assisted “vibe coding,” where the model replicated malicious behavior one-to-one while comments claimed the code was only a simulation; although the test artifacts are not executed during normal tool operation, users could trigger damage by manually running them. Separate academic work summarized by Bruce Schneier described **side-channel attacks against LLM inference**, where data-dependent timing and token/packet-size patterns (including those introduced by efficiency techniques like speculative decoding) can leak information about user prompts even over encrypted channels. Reported impacts include inferring conversation topics with high accuracy and, in some settings, recovering sensitive data such as phone numbers or credit card numbers via active probing. In parallel, an SC Media segment discussed the operational upside of **LLM-driven secure code analysis**, citing results that improved security across hundreds of open-source projects but noting the importance of human validation and patching effort; an OSINT Team post provided a cautionary, practitioner-level example of how easily malware can be accidentally executed during analysis, reinforcing the need for disciplined handling and isolation when working with suspicious files.
Jun 29, 2026
Large language models (LLMs) present a dual-use dilemma in cybersecurity, as their capabilities can be leveraged for both defensive and offensive purposes. Security researchers have identified purpose-built malicious LLMs, such as WormGPT and KawaiiGPT, which are designed to facilitate cybercrime by generating convincing phishing content and rapidly producing or modifying malicious code. The thin line between beneficial and harmful use of LLMs is defined largely by developer intent and the presence or absence of ethical safeguards, raising concerns about the proliferation of offensive AI tools in the threat landscape. In addition to malicious use, LLMs face significant challenges in maintaining privacy and security due to contextual integrity failures and regulatory-driven censorship. Research from Microsoft highlights the need for AI agents to respect contextual privacy norms, as current models may inadvertently leak sensitive information. Meanwhile, the DeepSeek-R1 model demonstrates how geopolitical censorship mechanisms can introduce security flaws, such as insecure code generation and broken authentication, especially when handling politically sensitive prompts. These issues underscore the urgent need for robust privacy controls and security-aware development practices in the deployment of LLM-powered systems.
Jun 29, 2026
A newly discovered zero-click attack, dubbed **Shadow Escape**, is enabling threat actors to exfiltrate vast amounts of sensitive data—including Social Security numbers, financial information, and medical records—from organizations using popular AI assistants. The attack exploits the Model Context Protocol (MCP), a standard used to connect large language models such as *ChatGPT*, *Claude*, and *Gemini* to internal databases and tools. By embedding concealed instructions within seemingly benign documents, attackers can trigger AI assistants to extract and transmit private data without any user interaction or awareness. Researchers from Operant AI warn that the attack leverages default MCP permissioning, making it easy to perpetrate and difficult to detect, with the potential for trillions of records to be compromised and sold on the dark web. The attack does not require traditional phishing or user error; instead, it relies on the AI assistant's legitimate access to sensitive information, which is then abused for stealthy data exfiltration. Organizations are urged to audit their AI agent deployments and review MCP configurations to mitigate this emerging threat.
Jun 29, 2026