Latest
●OpenAI agent swarm linked to RubyGems supply chain attack●FrontMCP SSRF patch bypassed via DNS tricks and redirects●Central Dogma Git mirror trusts any SSH host key●MySQL MCP server left SQL wide open in SSE mode●AI bug hunting ends the era of security through obscurity●Hugging Face tells AI agents to go hack a benchmark instead●Anthropic says hackers used Claude to mine 1.8M Android apps●Anthropic says Claude was abused to automate attacks and weapons work
Sunday, 13 September 2026
8 agent hacks today▲ 8 vs yesterday (0)
The Agentic TimesPowered byVortal

Incident database

EchoLeak: zero-click prompt injection in Microsoft 365 Copilot

Researchers at Aim Security found that a crafted email could make Microsoft 365 Copilot exfiltrate data from a user's tenant with no clicks, tracked as CVE-2025-32711.

Occurred 15 January 2025 · Disclosed 11 June 2025 · Record updated 13 September 2026

Impact

Sensitive data reachable by Copilot (emails, files, chats) could be exfiltrated by any external sender. Microsoft patched server-side before disclosure; no customer action was required.

Our coverage

Sources

  1. aim.securityhttps://www.aim.security/lp/aim-labs-echoleak-blogpost
  2. nvd.nist.govhttps://nvd.nist.gov/vuln/detail/CVE-2025-32711
  3. msrc.microsoft.comhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-32711