chroma_researchFirst-partyResearch
AI score68English translation is being prepared.
←research
research
English text is being prepared.
- Public reading groups
- 3
- Last 30 days
- 1
- Directory status
- Legacy topic
Latest reading groups
Duplicate reports of the same fact are grouped- Cato AI LabsFirst-partyResearchAI score81
Aim Labs discloses the complete attack chain of the M365 Copilot zero-click vulnerability EchoLeak
Aim Labs disclosed the zero-click vulnerability EchoLeak in Microsoft 365 Copilot: an attacker only needs to send a single email to the victim to exfiltrate sensitive data in the Copilot context without the user's awareness. The attack chain consists of three vulnerabilities, which in sequence bypass the XPIA prompt injection classifier, the sanitization of external links and images, and, with the help of SharePoint and Teams URLs, bypass CSP restrictions. Aim Labs calls the core technique LLM Scope Violation and believes that similar design flaws may also exist in other RAG-based chatbots and AI agents, and states that Microsoft has confirmed that no customers were affected.
Why read thisAim Labs broke down the zero-click data exfiltration chain of M365 Copilot and provided protection ideas that can be transferred to other RAG applications.
- Cato AI LabsFirst-partyResearchAI score73
Aim Labs discloses Cursor MCP auto-start remote code execution vulnerability CurXecute
Aim Labs discovered a high-severity vulnerability, CurXecute, in the Cursor IDE that can lead to full remote code execution, tracked as CVE-2025-54135, with a severity rating of 8.6. The attack path is: when Cursor connects to an MCP server that reads external content (such as Slack), a single poisoned prompt can induce the agent to rewrite ~/.cursor/mcp.json; Cursor then immediately executes newly added entries in that file and writes them to disk before the user confirms, thereby executing attacker commands with the user's privileges. Cursor has fixed this in version 1.3; earlier versions remain affected.
Why read thisThe original text fully discloses the chain by which Cursor auto-starts via MCP with injected commands, helping developers understand the permission boundaries of agent tool invocation.