Microsoft Security Incident
The "Whisper Leak" is a novel side-channel attack that infers language model conversation topics by analyzing network packet sizes and timings, even when communications are protected by end-to-end TLS encryption. This allows attackers observing network traffic to deduce sensitive information about user prompts, posing significant privacy risks to users and enterprises.
What Happened
The "Whisper Leak" is a novel side-channel attack that infers language model conversation topics by analyzing network packet sizes and timings, even when communications are protected by end-to-end TLS encryption. This allows attackers observing network traffic to deduce sensitive information about user prompts, posing significant privacy risks to users and enterprises.
Why This Matters
Current evidence identifies a security issue involving Microsoft, but does not yet support a more specific impact claim.
Recommended Action
No confirmed vendor remediation is available in the current evidence. Confirm whether Microsoft is present in your environment and review the affected configuration.
Exposure
Exposure unknown
Nov 07, 2025 05:30
Exposure reason: This incident does not currently match a technology in My AI Stack.
Exploitation status: UNKNOWN
Primary entities:
Timeline
-
Incident first seen
Nov 07, 2025 05:30BugSkan first recorded this incident.
-
Whisper Leak: A novel side-channel attack on remote language models - Microsoft
Nov 07, 2025 05:30microsoft.com · Research
Sources
microsoft.com · Nov 07, 2025 05:30
The "Whisper Leak" is a novel side-channel attack that infers language model conversation topics by analyzing network packet sizes and timings, even when communications are protected by end-to-end TLS encryption. This allows attackers observing network traffic to deduce sensitive information about user prompts, posing significant privacy risks to users and enterprises.
Open publisher sourceMy AI Stack Match
Create an account to see which incidents overlap with your AI stack.