irzubal

Issue 001September 27, 2026 1 incident / 3 OWASP items / 4 ATLAS techniques

irzubal

How AI systems get broken, and how to defend them.

I print real AI security incidents in two inks: red for the flaw the attacker found, blue for the control the defender missed. Where they overlap it turns purple, which is what purple teaming is. Every analysis is mapped to the OWASP LLM Top 10 and MITRE ATLAS.

Lead story

AI system vulnerability Critical

EchoLeak: Leaking data from Microsoft 365 Copilot with a single email

Aim Labs showed that M365 Copilot could follow hidden instructions in an incoming email and carry internal data out of the organisation without the user clicking anything. Microsoft fixed it server-side.

Microsoft 365 CopilotCVE-2025-32711

Read the analysis