←Search results

Search “OpenAI”

By relevance · Total 261 results Clear search

Thursday

Tuesday

Wednesday

Wednesday

Monday

Wednesday

Friday

Friday

Wednesday

Friday

Thursday

Sunday

Saturday

Thursday

Wednesday

Tuesday

Thursday

Saturday

  1. Cato AI LabsSelected

    Aim Labs discloses the complete attack chain of the M365 Copilot zero-click vulnerability EchoLeak

    Aim Labs disclosed the zero-click vulnerability EchoLeak in Microsoft 365 Copilot: an attacker only needs to send a single email to the victim to exfiltrate sensitive data in the Copilot context without the user's awareness. The attack chain consists of three vulnerabilities, which in sequence bypass the XPIA prompt injection classifier, the sanitization of external links and images, and, with the help of SharePoint and Teams URLs, bypass CSP restrictions. Aim Labs calls the core technique LLM Scope Violation and believes that similar design flaws may also exist in other RAG-based chatbots and AI agents, and states that Microsoft has confirmed that no customers were affected.

    Aim Labs disclosed the zero-click vulnerability EchoLeak in Microsoft 365 Copilot: an attacker only needs to send a single email to the victim to exfiltrate sensitive data in the Copilot context without the user's awareness. The attack chain consists of three vulnerabilities, which in sequence bypass the XPIA prompt injection classifier, the sanitization of external links and images, and, with the help of SharePoint and Teams URLs, bypass CSP restrictions. Aim Labs calls the core technique LLM S

    Matched fieldsBody

    #research#Safety / alignment#RAG#Microsoft

Tuesday

Sunday