搜索“Microsoft”

ng to exfiltrate sensitive information. This vulnerability is common in AI applications and agents, and it’s actually similar to one we discussed last year in GitHub Copilot which Microsoft fixed. Exploit Demonstration For the proof-of-concept I use a pre-existing demo that created a longer time ago. It happened to just work with Amp as well. The prompt injection is hosted on a website which asks the AI to “backup” information to a third-party site by rendering an image and including previous ch

匹配字段正文

all models are vulnerable to such invisible prompt injection attacks. Recommendations and Fix There are actually more attack angles then just the YOLO mode example I shared. When Microsoft asked me if there is any more info I have, I had looked a bit more and noticed there are other problematic places, for instance .vscode/tasks.json that the AI can write to, or adding fake malicious MCP servers, etc which can lead to code execution. And the AI can reconfigure the user interface and configurati

匹配字段正文

nnel. This is the web request the server received: As you can see, the server received the Base64-encoded token. Most vendors classify such vulnerabilities with High severity, and Microsoft marks such zero-click data leaks even Critical in their AI Bug Bar. Scary stuff. Responsible Disclosure March 13th, 2025: Disclosed to All-Hands AI via the GitHub security tab of the project; March 20th, 2025: Follow up, no response; March 30th, 2025: Vulnerability not triaged. Hence, I created a public ticke

匹配字段正文

cret, the browser will URL encode the hidden characters and send them as part of the HTTP request. This is something, I first demonstrated last year with the Copirate research and Microsoft Copilot that Microsoft addressed by the way. Here is what happened when I clicked the link that Devin sent to Slack: You can expand the image to see the full screen version. This is an important reminder of how the output of LLMs can have side effects that don’t surface immediately but surface in downstream s

匹配字段正文

. Conclusion This bug highlighted an interesting vulnerability that I consider a typical classical security issue. In the beginning of my career, I worked on filesystem drivers at Microsoft (WinFS and SQL Server), and back then I learned that file system security is actually quite difficult to get right. My main take-away is that AI system at large, but especially MCP servers, often suffer from “classic” vulnerability types that we sometimes haven’t seen in a long time. References Newer →; Conta

匹配字段正文

AI/ML Microsoft has updated Visual Studio Code (VS Code) to version 1.102 with another bundle of Copilot features including general availability of MCP (Model Context Protocol) support. In the summary of key features in this release, 8 out of 9 are Copilot related, leaving just one (scroll the editor on middle click) as a non-AI feature. MCP support is now generally available, and there is a new MCP Servers section in the VS Code Extensions view. This links to an MCP list on the VS Code website,

匹配字段正文

cture. It runs on-premises or at the network edge, so recorded calls, medical dictations, and confidential meetings never touch external servers. Azure lets you pick a region, but Microsoft still owns the hardware. Cartesia puts everything in your rack, giving you complete control. They back this approach with SOC 2 credentials and full audit logs that plug into your existing security tools. You control retention, access policies, and deletion schedules without complicated shared-responsibility

匹配字段正文

they say yes, do they mean they’re rebuilding their invoice processing around an LLM or that someone in marketing does mockups with MidJourney sometimes? Google IO 2025 Google and Microsoft have given charts of ‘tokens generated’, and even label the axis, but this is very much like reporting bandwidth growth in 1996: it looks great and certainly tells us that something is going up, but there are too many multipliers to know what that something really is. Usage and users are growing, yes, but mea

匹配字段正文

When the Model Context Protocol (MCP) came out it reminded me of the Common Object Model (COM) from Microsoft. COM has been around for decades and it’s used for programming, scripting, sharing of functionality at a binary/object level across languages and hosts. Via DCOM all of this can even be done remotely, and well, it’s also useful for red teaming. A lot of software on Windows was/is implemented as COM objects, including Microsoft Office. Here are some of the similarities of the two standard

匹配字段正文

ise reduction with minimal speech distortion using this approach. Transformer Models use attention-based architectures showing promising results for complex, non-stationary noise. Microsoft's research demonstrates how transformers outperform traditional methods in challenging environments. Vapi's flexible 'Bring Your Own Model' options accommodate custom noise reduction models, letting developers integrate preferred techniques. Choosing the Right Approach Selecting between traditional and ML met

匹配字段正文

M Granite, and the many countless people & labs in the community. GGML Thank you to the GGML team for the tensor library that powers Ollama’s inference. Being able to access GGML directly from Go has given a portable way to design custom inference graphs and tackle harder model architectures not available before in Ollama. Hardware partners Thank you to hardware partners for collaborating and helping to improve inference on a large number of devices - NVIDIA, AMD, Qualcomm, Intel, and Microsoft.

匹配字段正文

they all suffer from prompt injection and confused deputy threats. Many of the exploits we have discussed in the past involved tool invocation, from Zapier and ChatGPT exploits to Microsoft Copirate exploit to search email before leaking them, all of these required to know what tools are accessible and how to invoke them. So I figured, I spend some time explaining how I go about debugging and discovering things, in this case with MCP. Anthropic discusses prompt injection and other risks in their

匹配字段正文

overview of the various techniques: Unicode Tags We discussed this at length in the ASCII Smuggler post in the past, and highlighted real-world exploits using this technique with Microsoft Copilot and a few other LLM Chatbots. We also got fixes in from a few vendors at the API level, which is great! This technique is unique because many LLMs inherently interpret Unicode Tag characters as instructions. These characters can also be generated by LLMs, enabling data exfiltration. Variant Selectors

匹配字段正文

ks especially to Josh Achiam, Boaz Barak and Aleksander Madry for reviewing drafts of this. By using the term AGI here, we aim to communicate clearly, and we do not intend to alter or interpret the definitions and processes that define our relationship with Microsoft. We fully expect to be partnered with Microsoft for the long term. This footnote seems silly, but on the other hand we know some journalists will try to get clicks by writing something silly so here we are pre-empting the silliness…

匹配字段正文

ls remain essential even after patches and Aim Security supplies these state of the art protections. In June we disclosed EchoLeak, the first zero‑click exfiltration chain against Microsoft 365 Copilot. It proved that untrusted content (a single inbound e‑mail) could hijack an LLM’s inner loop and leak whatever data the model could see - without user action. EchoLeak underscored another critical lesson: if outside context can steer an AI-agent, any agent can have its control flow hijacked and it

匹配字段正文

ng, where the model learns its most basic understanding of language. The second trick is far more uncommon: weight initialization via tiling for the larger model size, inspired by Microsoft’s Phi family of models. This one’s based on the following realization: Why initialize the ModernBERT-large’s initial weights with random numbers when we have a perfectly good (if we dare say so ourselves) set of ModernBERT-base weights just sitting there? And indeed, it turns out that tiling ModernBERT-base’s

匹配字段正文

rything from invention to forming relationships. Copilot will be there for you, in your corner, by your side and always strongly aligned with your interests. Mustafa Suleyman, CEO Microsoft AI In the field of AI, we often get caught up in the technical details. We spend our time talking about parameters and compute. The focus is on training runs, datacenters and the latest techniques. This is natural and inevitable when operating on the frontiers of something new, where the details do really mat

匹配字段正文

ce efficiency compared to models of a similar scale and larger such as Gemma-2B (Google), SmolLM-1.7B (Huggingface), OpenELM-1.1B (Apple), StableLM-1.6B (StabilityAI) and Phi-1.5 (Microsoft); Zamba2-mini is extremely inference-efficient, achieving 1.67x faster time-to-first-token and a 23.3% reduction in memory overhead compared to Phi1.5-1.3B; We release the model weights open-source (Apache 2.0) Zamba2-mini (1.2B) Efficiency Zamba2-mini achieves the quality of a 2-3B dense transformer while on

匹配字段正文

e and so you wouldn’t have Google’s quality. In tech this is called a network effect; in competition theory it’s called a natural monopoly. Hence, Bing. Satya Nadella claimed that Microsoft has invested $100bn in search to date, yet Bing has only 5% of US search traffic, and both its results and its revenue-per-query are worse. It’s stuck on the wrong side of that virtuous circle. However, there's another virtuous circle: everyone uses Google because it's the default, it's the default because it

匹配字段正文

ck music. Like that kid, Suno gets better the more our AI learns. We train our models on medium- and high-quality music we can find on the open internet — just as Google's Gemini, Microsoft's Copilot, Anthropic's Claude, OpenAI's ChatGPT, and even Apple's new Apple Intelligence train their models on the open internet. The timing of this lawsuit was somewhat surprising. When this lawsuit landed, Suno was, in fact, having productive discussions with a number of the RIAA's major record label member

匹配字段正文