The Security
Audit

We examine the assumptions inside intelligent systems and the security decisions that shape them.

Recent articles

AI Security October 20, 2026

EchoLeak: How a Single Email Turned Microsoft 365 Copilot Into a Zero-Click Exfiltration Channel

Aim Security's EchoLeak disclosure showed how an unopened email could steer Microsoft 365 Copilot to retrieve internal data and carry it out through a rendered Markdown reference, breaking the boundary between untrusted content and privileged context.

6 min read↗

Secure Systems October 20, 2026

MCP Tool Poisoning and Rug Pulls: When the Agent's Tools Become the Attacker

Invariant Labs' April 2025 disclosure showed that Model Context Protocol tool descriptions, which the model reads but the user rarely sees in full, can carry hidden instructions, and that a server can change those descriptions after approval.